Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 34 of 125

  • 9.1 /10 Critical
    CVE-2026-92414 No auth

    Apache Jackrabbit - Authentication Bypass

    Apache Jackrabbit 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5 contain a session fixation vulnerability caused by attaching cached authenticated sessions on token matches without credential checks, letting attackers reuse sessions across users, exploit requires crafted token headers.

  • 9.1 /10 Critical
    CVE-2026-81535 No auth

    wolfSSH - Authorization Bypass

    wolfSSH through 1.5.0 built with --enable-fwd contains an authorization bypass caused by missing checks on forwarded-tcpip channel opens in DoChannelOpen(), letting malicious SSH peers allocate unbounded buffers and open unauthorized forwarding channels, exploit requires SSH session with forwarding enabled.

  • 9.8 /10 Critical
    CVE-2026-76501

    Cisco NX-OS - Remote Code Execution & Denial of Service

    Cisco NX-OS Software contains a remote code execution and denial of service vulnerability caused by improper input validation in the Segment Routing over IPv6 (SRv6) NGOAM feature, letting unauthenticated remote attackers execute arbitrary code with root privileges or cause device reloads, exploit requires NGOAM and SRv6 features enabled.

  • 9.8 /10 Critical
    CVE-2026-76500

    CVE-2026-76500

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76500 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

  • 9.8 /10 Critical
    CVE-2026-76499

    CVE-2026-76499

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.  

  • 9.8 /10 Critical
    CVE-2026-76498 No auth

    Cisco Application Policy Infrastructure Controller - Broken Access Control

    Cisco Application Policy Infrastructure Controller contains improper access control vulnerabilities caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-76486

    Cisco NX-OS - Remote Code Execution & Denial of Service

    Cisco NX-OS Software contains a remote code execution and denial-of-service vulnerability caused by improper input validation in the VXLAN OAM (NGOAM) feature, letting unauthenticated remote attackers execute code with root privileges or cause device reloads, exploit requires NGOAM feature enabled.

  • 9.8 /10 Critical
    CVE-2026-76485

    Cisco NX-OS - Remote Code Execution & Denial of Service

    Cisco NX-OS Software contains a remote code execution and denial of service vulnerability caused by improper input validation in the VXLAN OAM feature, letting unauthenticated remote attackers execute code with root privileges or cause device reloads, exploit requires NGOAM feature enabled.

  • 9.1 /10 Critical
    CVE-2026-76483 No auth

    Cisco License On-Prem - Hardcoded Credentials

    Cisco License On-Prem contains an insufficiently protected credentials vulnerability caused by weak credential protection, letting attackers potentially access sensitive credentials, exploit requires no special conditions.

  • 10.0 /10 Critical
    CVE-2026-76482

    Cisco License On-Prem - Improper Input Verification

    Cisco License On-Prem contains an improper input verification vulnerability caused by failure to properly verify inputs, letting attackers potentially exploit the system, exploit requires unspecified conditions.

  • 9.8 /10 Critical
    CVE-2026-76480 No auth

    Cisco License On-Prem - Authentication Bypass

    Cisco License On-Prem contains an authentication bypass caused by improper authentication implementation, letting attackers bypass authentication, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-76471 No auth

    Cisco NX-OS - Command Injection

    Cisco NX-OS Software contains a command injection vulnerability in the NX-API due to insufficient input validation, letting unauthenticated remote attackers execute arbitrary code with root privileges or cause denial of service, exploit requires sending crafted HTTP requests.

  • 9.8 /10 Critical
    CVE-2026-76465 No auth

    Cisco NX-OS - Remote Code Execution & Denial of Service

    Cisco NX-OS Software for Cisco Nexus 3000 and 9000 Series Switches contains a remote code execution and denial of service vulnerability caused by improper validation of MPLS echo-request packets, letting unauthenticated remote attackers execute code with root privileges or cause device reload, exploit requires sending crafted MPLS echo-request packets.

  • 9.6 /10 Critical
    CVE-2026-76464 No auth

    Cisco Networking - Buffer Overflow

    Cisco networking products contain buffer overflow vulnerabilities caused by improper buffer management, letting attackers potentially cause denial of service or execute arbitrary code, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-76459 No auth

    Cisco NX-OS - Out-of-Bounds Write

    Cisco NX-OS contains out-of-bounds write vulnerabilities caused by improper bounds checking, letting attackers potentially corrupt memory or cause denial of service, exploit requires network access.