Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 48 of 125

  • 10.0 /10 Critical
    CVE-2026-104610 No auth

    Tenda HG7, HG9, HG10 - Buffer Overflow

    Tenda HG7, HG9, and HG10 300001138_en_xpon contain a stack-based buffer overflow caused by manipulation of the "Ethtype" argument in /boaform/formLoopBack of Boa Web Server, letting remote attackers execute code, exploit requires crafted request.

  • 9.0 /10 Critical
    CVE-2026-104019 Auth required

    Amazon SageMaker Distribution - OS Command Injection

    Amazon SageMaker Distribution 2.x < 2.14.12, 3.x < 3.9.12, 4.0.x < 4.0.11, 4.1.x < 4.1.11, 4.2.x < 4.2.8, 4.3.x < 4.3.5, and 4.4.x < 4.4.3 contains an OS command injection caused by unneutralized interpolation of crafted connection resource property in Studio Space startup validation script, letting authenticated remote users with project contributor permissions execute arbitrary commands and obtain temporary execution role credentials, exploit requires project contributor permissions.

  • 10.0 /10 Critical
    CVE-2026-103956 PoC publicNo auth

    Loom for AWS - Authentication Bypass

    Loom for AWS < 1.6.1 contains a broken authentication caused by missing authentication for critical functions in the authentication dependency, letting remote actors obtain super-admin authority over the agent control plane, exploit requires no identity provider configured.

  • 9.8 /10 Critical
    CVE-2026-103877

    Apache Directory LDAP API - Insecure Deserialization

    Apache Directory LDAP API >= 2.1.0 < 2.1.9 contains an insecure deserialization vulnerability caused by processing serialized Java classes in schema objects from untrusted LDAP servers, letting attackers achieve potential remote code execution, exploit requires a rogue or compromised LDAP server or pre-TLS man-in-the-middle.

  • 9.4 /10 Critical
    CVE-2026-103765 No auth

    Mooncake - Authentication Bypass

    Mooncake <= 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler, letting unauthenticated attackers read, overwrite, and delete transfer engine metadata keys, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-103764 No auth

    Mooncake transfer engine - Remote Code Execution & Information Disclosure

    Mooncake transfer engine < 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader, letting unauthenticated attackers read and write arbitrary process memory via TCP transport data port, exploit requires crafted SessionHeader with arbitrary addr and size values.

  • 9.1 /10 Critical
    CVE-2026-103648 PoC publicNo auth

    image-downloader - Path Traversal

    image-downloader 4.3.0 contains a path traversal caused by uncontrolled download URL, letting attackers write downloaded response data outside the configured destination directory, exploit requires control over download URL.

  • 9.6 /10 Critical
    CVE-2026-103630 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free caused by improper memory handling in FedCM, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-103628 No auth

    Google Chrome - Out of Bounds Write

    Google Chrome < 154.0.8037.97 contains an out of bounds write in WebGL caused by improper bounds checking, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-103626 No auth

    Google Chrome - Broken Access Control

    Google Chrome on Windows < 154.0.8037.97 contains a broken access control caused by incorrect authorization in FileSystem, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires social engineering.

  • 9.3 /10 Critical
    CVE-2026-102795 No auth

    Apache Traffic Server - Broken Access Control

    Apache Traffic Server 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 contains an improper access control vulnerability caused by flawed authorization checks, letting attackers bypass access restrictions, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2023-54405 CISA KEVNo auth

    H3C CVM - Unrestricted File Upload

    H3C CVM contains an unauthenticated arbitrary file upload vulnerability caused by insufficient validation of the token parameter in /cas/fileUpload/upload, letting remote attackers upload malicious files and achieve remote code execution, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-96659 Auth required

    Foreman - Broken Access Control

    Foreman contains an information disclosure and command execution vulnerability caused by insufficient access control in template preview endpoints, letting authenticated low-level Viewer users access sensitive data and execute commands under insecure configurations.

  • 9.9 /10 Critical
    CVE-2026-96658 Auth required

    Foreman - Remote Code Execution

    Foreman contains a remote code execution caused by improper handling of delegated methods in the templating engine, letting authenticated low-permission attackers bypass safemode sandbox and execute arbitrary commands.

  • 9.1 /10 Critical
    CVE-2026-92966 PoC publicNo auth

    Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress - Stored XSS

    Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.7.0 contains a stored XSS caused by improper validation before running do_shortcode, letting unauthenticated attackers execute arbitrary shortcodes via booking flow.