Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 55 of 125

  • 9.3 /10 Critical
    CVE-2026-102147 No auth

    Kiteworks Core - Stored XSS

    Kiteworks Core contains a stored XSS caused by improper sanitization of user input, letting unauthenticated attackers execute arbitrary JavaScript in an administrator's session, exploit requires administrator to view crafted content.

  • 9.8 /10 Critical
    CVE-2026-102115 No auth

    Kiteworks Core - Authentication Bypass

    Kiteworks Core contains a broken authentication caused by improper validation of a parameter in the password reset workflow, letting unauthenticated attackers reset passwords and authenticate as users, including admins, without the reset link.

  • 9.1 /10 Critical
    CVE-2026-102106 No auth

    Kiteworks Email Protection Gateway - Authentication Bypass

    Kiteworks Email Protection Gateway contains a broken authentication caused by inconsistent enforcement of administrator password checks in an administrative service, letting attackers bypass authentication to manage users and domains.

  • 9.1 /10 Critical
    CVE-2026-102105 No auth

    Kiteworks Email Protection Gateway - Server-Side Request Forgery

    Kiteworks Email Protection Gateway < 9.5.0 contains a server-side request forgery caused by rendering message content referencing external resources, letting remote unauthenticated attackers induce requests to internal systems.

  • 9.1 /10 Critical
    CVE-2026-102104 No auth

    Kiteworks Email Protection Gateway - Server-Side Request Forgery

    Kiteworks Email Protection Gateway < 9.5.0 contains a server-side request forgery caused by crafted requests during online certificate status checks, letting remote unauthenticated attackers induce requests to internal network destinations.

  • 9.1 /10 Critical
    CVE-2026-102103 No auth

    Kiteworks Email Protection Gateway - Server-Side Request Forgery

    Kiteworks Email Protection Gateway < 9.5.0 contains a server-side request forgery caused by crafted requests triggered during certificate revocation list retrieval, letting remote unauthenticated attackers induce requests to internal networks.

  • 9.1 /10 Critical
    CVE-2026-102102 No auth

    Kiteworks Email Protection Gateway - Server-Side Request Forgery

    Kiteworks Email Protection Gateway < 9.5.0 contains a server-side request forgery caused by crafted requests triggered during issuer certificate retrieval in inbound messages, letting remote unauthenticated attackers induce requests to internal networks.

  • 9.1 /10 Critical
    CVE-2026-102095 No auth

    Kiteworks Email Protection Gateway - Server-Side Request Forgery

    Kiteworks Email Protection Gateway < 9.5.0 contains a server-side request forgery caused by inadequate restriction of server-side URL fetches in message content, letting remote unauthenticated attackers disclose internal data and affect internal services, exploit requires crafted message.

  • 9.8 /10 Critical
    CVE-2026-100512 No auth

    Nested Pages - PHP Object Injection

    Nested Pages <= 3.3.2 contains a PHP Object Injection caused by unsafe handling of serialized objects, letting attackers execute arbitrary code remotely, exploit requires crafted serialized input.

  • 10.0 /10 Critical
    CVE-2026-96587

    Viidure Android - Hardcoded Credentials

    Viidure Android application contains hardcoded plaintext cloud storage credentials in its compiled code, letting attackers access and modify critical platform storage including firmware and application binaries, exploit requires access to the app binary.

  • 9.6 /10 Critical
    CVE-2026-95357 PoC publicNo auth

    Google Chrome - Remote Code Execution

    Google Chrome on Android < 154.0.8037.57 contains an out of bounds write in GPU caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-95356 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free caused by improper memory handling in WindowDialog, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-95350 PoC publicNo auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.57 contains a buffer overflow in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-95349 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.57 contains a buffer overflow in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-95347 No auth

    Google Chrome - Use After Free

    Google Chrome on Mac < 154.0.8037.57 contains a use after free vulnerability in Updater caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted network traffic.