Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 56 of 166
- 9.8 /10 CriticalCVE-2026-69639 No auth
Windows Libarchive - Remote Code Execution
Windows Libarchive contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-69634 No auth
Windows iSCSI - Remote Code Execution
Windows iSCSI contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-69227 No auth
Portal for ArcGIS - Authentication Bypass
Portal for ArcGIS contains an authentication bypass caused by unauthenticated access to certain /portaladmin/local API endpoints, letting unauthenticated attackers access administrative functionality, exploit requires specific conditions.
- 9.1 /10 CriticalCVE-2026-65173 No auth
NVIDIA AIStore - Broken Authentication
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint, letting unauthenticated remote attackers submit crafted token-revocation lists, leading to data tampering and denial of service.
- 10.0 /10 CriticalCVE-2026-65162
NVIDIA AIStore - Remote Code Execution & Privilege Escalation & Information Disclosure & Data Tampering & Denial of Service
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings, letting remote attackers execute code, escalate privileges, disclose information, tamper data, and cause denial of service, exploit requires access to the vulnerable API.
- 9.6 /10 CriticalCVE-2026-63354 No auth
Affected Devices - Stored XSS
Affected devices contain a stored XSS vulnerability caused by improper validation and sanitization of visual marker data in imported CSV trace files, letting attackers execute JavaScript in authorized users' browsers, exploit requires user with 'Read diagnostics' rights to import crafted trace file.
- 9.6 /10 CriticalCVE-2026-63353 No auth
Affected devices - Stored XSS
Affected devices contain a stored XSS vulnerability caused by improper sanitization of comment fields in imported trace files, letting attackers execute JavaScript in authorized users' browsers, exploit requires user with 'Read diagnostics' rights to import crafted trace file.
- 9.6 /10 CriticalCVE-2026-63350 No auth
Affected Devices - Stored XSS
Affected devices contain a stored XSS vulnerability caused by improper restriction of executable content in imported trace files, letting attackers execute JavaScript in authorized users' browser sessions, exploit requires user with 'Read diagnostics' function right to import crafted trace file.
- 9.8 /10 CriticalCVE-2026-63146 No auth
Omnispace Agora Project - Remote Code Execution
Omnispace Agora Project < 26.10.0 contains a code injection vulnerability caused by unescaped attacker-controlled values written into config.inc.php combined with SQL injection via PDO::ATTR_EMULATE_PREPARES, letting unauthenticated attackers execute remote code, exploit requires ability to trigger installer.
- 9.1 /10 CriticalCVE-2026-55695 Auth required
FearlessCMS - Remote Code Execution
FearlessCMS <= 0.1.2b contains a command injection caused by unauthenticated Git repository URL setting in admin/updater-handler.php, letting authenticated administrators execute arbitrary PHP code with web server privileges, exploit requires admin authentication.
- 10.0 /10 CriticalCVE-2026-55675 No auth
Salty Documentation Repository - Secret Disclosure
Salty documentation repository prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 contains a secret disclosure vulnerability caused by executing attacker-controlled setup.py or PEP 517 build hooks in privileged workflows, letting attackers disclose secrets and compromise the system, exploit requires attacker control of fork content.
- 9.0 /10 CriticalCVE-2026-55562 Auth required
Cronicle - Stored XSS
Cronicle < 0.9.119 contains a stored XSS caused by improper encoding of attacker-controlled user full_name in Activity Log, letting authenticated or anonymous attackers execute scripts in administrator sessions, exploit requires admin to view Activity Log.
- 9.6 /10 CriticalCVE-2026-55183 No auth
RClone Manager - Cross-Site Request Forgery
RClone Manager < 0.2.7 contains a cross-site request forgery caused by unauthenticated local rclone rcd service with permissive CORS, letting malicious web pages access and modify user files and storage credentials, exploit requires user to open malicious web page.
- 9.1 /10 CriticalCVE-2026-54454 Auth required
OpenCATS - Remote Code Execution
OpenCATS < 0.10.0 contains a remote code execution caused by improper handling of uploaded files in ImportUI.php, letting authenticated users with Import privileges execute arbitrary PHP code via web-accessible temporary directory, exploit requires Import privileges.
- 9.8 /10 CriticalCVE-2026-53709
MCP Context Forge - Authentication Bypass
MCP Context Forge < 1.0.2 contains a broken authentication caused by use of a known JWT_SECRET_KEY and platform-admin bootstrap, letting remote unauthenticated attackers mint administrator tokens, exploit requires vulnerable signing key and bootstrap enabled.