Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 52 of 166
- 9.8 /10 CriticalCVE-2026-92909 No auth
Adobe Commerce - Broken Access Control
Adobe Commerce contains an incorrect authorization vulnerability that allows arbitrary code execution in the context of the current user, letting attackers execute arbitrary code without user interaction.
- 9.0 /10 Critical
- 9.1 /10 CriticalCVE-2026-92464 Auth required
Adobe Commerce - Remote Code Execution
Adobe Commerce contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires high privileges.
- 9.3 /10 CriticalCVE-2026-91013 No auth
Adobe Commerce - Stored XSS
Adobe Commerce contains a stored XSS caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, potentially leading to elevated access or session control, exploit requires victim to visit the vulnerable page.
- 10.0 /10 CriticalCVE-2026-90532 No auth
Adobe Experience Manager - Broken Access Control
Adobe Experience Manager contains an incorrect authorization vulnerability caused by improper access control, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 9.6 /10 CriticalCVE-2026-90531 Auth required
Adobe Experience Manager - Privilege Escalation
Adobe Experience Manager contains an XML External Entity Injection (XXE) vulnerability caused by improper restriction of XML external entity references, letting low-privileged attackers escalate privileges, exploit requires no user interaction.
- 9.3 /10 CriticalCVE-2026-90530 No auth
ColdFusion RDS - Path Traversal
ColdFusion RDS contains a path traversal vulnerability caused by improper limitation of pathname to restricted directories, letting attackers read arbitrary files outside intended scope, exploit requires no user interaction.
- 10.0 /10 CriticalCVE-2026-89309
CVE-2026-89309
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.
- 10.0 /10 CriticalCVE-2026-89111
SAP Cloud SDK for Python - Server Side Request Forgery
SAP Cloud SDK for Python contains a server side request forgery caused by improper validation of tenant_subdomain parameter in OAuth2 token requests, letting attackers exfiltrate client credentials by redirecting requests to attacker-controlled servers, exploit requires control over tenant_subdomain parameter.
- 9.9 /10 CriticalCVE-2026-89110 Auth required
SAP NetWeaver Visual Composer - Broken Access Control
SAP NetWeaver Visual Composer contains a broken access control vulnerability caused by insufficient authorization checks in portal functionality, letting low-privilege attackers invoke internal operations on remote systems, potentially leading to full system compromise.
- 9.1 /10 CriticalCVE-2026-89108 Auth required
SAP Manufacturing Integration and Intelligence - Broken Access Control
SAP Manufacturing Integration and Intelligence contains a broken access control vulnerability caused by insufficient enforcement of authorization boundaries in administrative functions, letting attackers with MII administrator privileges escalate privileges on the underlying Java application server, exploit requires MII administrator privileges.
- 9.9 /10 CriticalCVE-2026-89107 Auth required
SAP S/4HANA - Insecure Deserialization
SAP S/4HANA contains an insecure deserialization vulnerability caused by insufficient validation of input in rule definition functionality using a domain-specific scripting language, letting authenticated attackers with specific business privileges execute arbitrary ABAP code, exploit requires specific business privileges.
- 9.8 /10 CriticalCVE-2026-88178 No auth
Microsoft Office PowerPoint - Remote Code Execution
Microsoft Office PowerPoint contains a use after free vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-88156 No auth
Microsoft Office Outlook - Remote Code Execution
Microsoft Office Outlook contains a stack-based buffer overflow caused by improper handling of input, letting unauthorized attackers execute code remotely, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-88102 No auth
Windows Failover Cluster - Remote Code Execution
Windows Failover Cluster contains a use after free vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.