Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 42 of 125
- 9.6 /10 CriticalCVE-2026-106211 No auth
Google Chrome - Use After Free
Google Chrome < 155.0.8059.39 contains a use after free caused by improper memory handling in TabStrip, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML, exploit requires user interaction.
- 9.6 /10 CriticalCVE-2026-106197 No auth
Google Chrome - Use After Free
Google Chrome < 155.0.8059.39 contains a use after free vulnerability in the browser, caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.
- 9.1 /10 CriticalCVE-2026-106195 No auth
Google Chrome - Broken Access Control
Google Chrome < 155.0.8059.39 contains a broken access control vulnerability caused by incorrect authorization in Chromoting on Mac, letting remote attackers bypass system access restrictions via crafted network traffic.
- 10.0 /10 CriticalCVE-2026-106102 No auth
Quasar Framework - Stored XSS
Quasar Framework < 2.22.0 contains a stored XSS caused by improper encoding in the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js, letting attackers inject executable markup via dynamic page metadata, exploit requires attacker control over metadata.
- 9.8 /10 CriticalCVE-2026-106037 No auth
Mooncake - Authentication Bypass
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service binding to 0.0.0.0, letting unauthenticated attackers read, inject, delete cached KV data, and mount segments, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-106016 No auth
Firefox - Mitigation Bypass
Firefox contains a mitigation bypass caused by a flaw in the File Handling component, letting attackers bypass security mitigations, exploit requires no special conditions.
- 9.4 /10 CriticalCVE-2026-105863 No auth
Payload CMS - Authentication Bypass
Payload CMS > 3.0.0 and < 3.90.0 contains a broken authentication caused by mapping a custom field to a reserved authentication claim name, letting attackers place unintended values in issued authentication tokens, exploit requires login.
- 9.8 /10 CriticalCVE-2026-105859 No auth
Payload - Broken Access Control
Payload < 3.90.0 and canary < 4.0.0-canary.34 contain a broken access control vulnerability caused by lack of enforcement on collection or field-level access control when orderable is enabled, letting attackers modify collection documents remotely, exploit requires orderable enabled on collection or join field.
- 10.0 /10 CriticalCVE-2026-105857 No auth
Payload @payloadcms/plugin-form-builder - Remote Code Execution
Payload @payloadcms/plugin-form-builder < 3.90.0 and < 4.0.0-canary.34 contains a remote code execution caused by crafted form submissions, letting attackers execute code remotely on the server, exploit requires crafted form submission.
- 9.6 /10 CriticalCVE-2026-105848 Auth required
Payload @payloadcms/plugin-stripe - Broken Access Control
Payload @payloadcms/plugin-stripe < 3.90.0 and canary < 4.0.0-canary.34 contains a broken access control vulnerability caused by insufficient authorization on the Stripe REST proxy, letting authenticated users perform unintended Stripe operations, exploit requires user authentication.
- 9.8 /10 CriticalCVE-2026-105845 No auth
Payload - SQL Injection
Payload 3.0.0 < 3.88.0 and canary < 4.0.0-canary.27 contain a SQL injection caused by untrusted user queries through dynamic filters or joins in SQLite and Postgres adapters, letting attackers execute arbitrary SQL commands remotely, exploit requires ability to query readable collections.
- 9.3 /10 CriticalCVE-2026-105844 PoC publicNo auth
Payload CMS - Remote Code Execution
Payload CMS 3.0.0 < 3.88.0 and canary < 4.0.0-canary.27 contains a remote code execution caused by unauthenticated submission of prototype-sensitive field paths in @payloadcms/plugin-import-export, letting unauthenticated attackers execute code remotely, exploit requires the import-export plugin enabled.
- 9.0 /10 CriticalCVE-2026-105812 Auth required
Amazon Bedrock AgentCore Starter Toolkit - Remote Code Execution
Amazon Bedrock AgentCore Starter Toolkit < 0.3.14 contains a remote code execution caused by improper control of code generation in agent import functionality, letting authenticated same-account actors execute arbitrary code via crafted configuration values, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-105794 No auth
MsQuic - Man-in-the-Middle
MsQuic < 2.4.20, < 2.5.11, and < 2.6.1 contain a man-in-the-middle vulnerability caused by improper server certificate hostname verification in OpenSSL and QuicTLS backends, letting on-path attackers spoof servers, exploit requires network position.
- 9.1 /10 CriticalCVE-2026-105793 Auth required
Microsoft UFO - Command Injection
Microsoft UFO < 3.0.9 contains a command injection caused by unsanitized key_code parameter in press_key tool, letting authenticated Mobile MCP callers execute commands as Android shell user on authorized devices, exploit requires valid API key, adb, and authorized device.