Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 54 of 166

  • 9.8 /10 Critical
    CVE-2026-83770 No auth

    Windows Text Shaping - Remote Code Execution

    Windows Text Shaping contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83748 No auth

    Windows Error Reporting - Remote Code Execution

    Windows Error Reporting contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83693 No auth

    Windows Error Reporting - Remote Code Execution

    Windows Error Reporting contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-83662 No auth

    Adobe Experience Manager - Reflected XSS

    Adobe Experience Manager contains a reflected XSS caused by improper input sanitization, letting attackers inject malicious scripts to gain elevated access or control, exploit requires victim interaction with crafted URL or page.

  • 9.8 /10 Critical
    CVE-2026-83578 No auth

    Windows PowerShell - Remote Code Execution

    Windows PowerShell contains an integer underflow caused by improper input validation, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83519 No auth

    Windows Error Reporting - Remote Code Execution

    Windows Error Reporting contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83517 No auth

    Microsoft Windows Media Foundation - Remote Code Execution

    Microsoft Windows Media Foundation contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-78802 No auth

    SKYWORTH DIGITAL CO.,LTD SK-WR6640X - Remote Code Execution

    SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 contains a remote code execution vulnerability caused by unspecified issue, letting remote attackers execute arbitrary code, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-78799 No auth

    Quanxun Huiju Network Technology IK-Q3000 - Directory Traversal

    Quanxun Huiju Network Technology IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router <= iKuai8_3.7.23_Enterprise and <= iKuai 8_4.0.304-beta contains a directory traversal vulnerability allowing remote attackers to execute arbitrary code, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-77459 Auth required

    Argo CD - Broken Access Control

    Argo CD 2.10.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contains a broken access control vulnerability caused by omission of AppProject destination and resource authorization checks in PostDelete resource hooks, letting users with write access to an Application's Git repository create unauthorized cluster-scoped or namespaced resources during deletion, exploit requires write access to the Application's Git repository.

  • 9.3 /10 Critical
    CVE-2026-77099 No auth

    CVFS - Command Injection

    CVFS contains a command injection caused by input validation issue, letting attackers execute arbitrary commands, exploit requires crafted input.

  • 9.6 /10 Critical
    CVE-2026-75994 No auth

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability caused by improper access control in administrative network zone, letting attackers execute arbitrary code in the context of the current user, exploit requires network access to administrative zone.

  • 9.9 /10 Critical
    CVE-2026-75732 Auth required

    Adobe Experience Manager - Broken Access Control

    Adobe Experience Manager contains an incorrect authorization vulnerability that allows arbitrary code execution in the context of the current user, letting attackers gain elevated access or control, exploit requires no user interaction.

  • 9.3 /10 Critical
    CVE-2026-75120 No auth

    OpenText EnCase SAFE Agents - Authentication Bypass

    OpenText EnCase SAFE Agents contains an authentication bypass vulnerability caused by improper security controls during session establishment, letting unauthorized attackers establish connections to vulnerable Agents, exploit requires no authentication.

  • 9.0 /10 Critical
    CVE-2026-74043 Auth required

    Wazuh - Path Traversal

    Wazuh > 4.1.1 < 4.14.8 contains a path traversal caused by improper validation in upload_list_file, upload_rule_file, and upload_decoder_file, letting malicious cluster workers write files at arbitrary paths, exploit requires cluster key access.