Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 38 of 125

  • 9.1 /10 Critical
    CVE-2026-77178 No auth

    Oracle VM VirtualBox - Out of Bounds Write

    Oracle VM VirtualBox < 7.2.8 contains an out-of-bounds write caused by improper handling in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet network device model, letting guest OS users cause memory corruption on the host OS, exploit requires guest OS access.

  • 9.8 /10 Critical
    CVE-2026-76754 No auth

    ClearPass Policy Manager - SQL Injection

    ClearPass Policy Manager contains a sql injection caused by improper input sanitization in an affected interface, letting unauthenticated remote attackers execute arbitrary database commands, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-76753 No auth

    HPE Networking ClearPass Policy Manager - Remote Code Execution

    HPE Networking ClearPass Policy Manager contains a format string vulnerability in a service interface, letting unauthenticated remote attackers corrupt process memory and execute arbitrary code, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-76752 No auth

    HPE Networking ClearPass Policy Manager - Authentication Bypass

    HPE Networking ClearPass Policy Manager contains an authentication bypass caused by flaws in web-based management and API interfaces, letting unauthenticated remote attackers gain administrative access, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-76751 No auth

    ClearPass Policy Manager OnGuard - Remote Code Execution

    ClearPass Policy Manager OnGuard agent contains a missing integrity verification vulnerability, letting unauthenticated remote attackers execute arbitrary code with elevated agent privileges, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-76750 No auth

    HPE Networking ClearPass Policy Manager - Insecure Deserialization

    HPE Networking ClearPass Policy Manager contains an insecure deserialization vulnerability in the web interface, letting unauthenticated remote attackers execute arbitrary code.

  • 9.1 /10 Critical
    CVE-2026-76747 No auth

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow caused by improper input handling in an affected interface, letting unauthenticated remote attackers expose sensitive memory and cause denial of service, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-76746

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow vulnerability allowing unauthenticated adjacent attackers to expose sensitive memory contents and cause denial of service, exploit requires attacker to be adjacent.

  • 9.6 /10 Critical
    CVE-2026-76745

    AOS-S - Remote Code Execution

    AOS-S contains memory corruption vulnerabilities reachable by unauthenticated adjacent attackers, letting them execute arbitrary code remotely, exploit requires network adjacency.

  • 9.8 /10 Critical
    CVE-2026-76744 No auth

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow caused by improper input handling in an affected interface, letting unauthenticated remote attackers execute arbitrary code remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-76743

    AOS-S - Authentication Bypass

    AOS-S management interface contains an authentication bypass caused by improper authentication controls, letting unauthenticated remote attackers gain unauthorized access, exploit requires specific preconditions outside attacker control.

  • 9.8 /10 Critical
    CVE-2026-76742 No auth

    AOS-S - Authentication Bypass

    AOS-S contains an authentication bypass vulnerability in the web management interface, letting unauthenticated remote attackers gain unauthorized access, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-73278 No auth

    Gitea - Authentication Bypass

    Gitea contains a broken authentication vulnerability caused by missing WebAuthn challenge enforcement in OAuth2 and OpenID Connect sign-in paths when WebAuthn is the only second factor, letting attackers obtain full sessions without passkey verification, exploit requires authentication via external identity flow.

  • 9.6 /10 Critical
    CVE-2026-67273 Auth required

    Dell Container Storage Modules - Privilege Escalation

    Dell Container Storage Modules < 1.18.0 contain a template injection caused by improper neutralization of special elements in the template engine, letting low privileged remote attackers escalate privileges, exploit requires remote access.

  • 9.9 /10 Critical
    CVE-2026-67269 Auth required

    Dell Container Storage Modules (CSM) Operator - Privilege Escalation

    Dell Container Storage Modules (CSM) Operator < 1.18.0 contains an improper privilege management vulnerability in the ContainerStorageModule Custom Resource reconciler, letting low privileged remote attackers escalate privileges to root on cluster nodes, exploit requires low privileged access.