Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 56 of 125

  • 9.6 /10 Critical
    CVE-2026-95339 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free vulnerability in ServiceWorker, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-95331 No auth

    Google Chrome - Out of Bounds Write

    Google Chrome < 154.0.8037.57 contains an out of bounds write caused by improper memory handling in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-95329 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Android < 154.0.8037.57 contains an out of bounds write in WebGL caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-95325 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free vulnerability in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-95318 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 154.0.8037.57 contains a buffer overflow in Video component caused by improper handling of crafted HTML pages, letting remote attackers execute arbitrary code outside the sandbox, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-95313 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free vulnerability in Fullscreen, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-95311 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 154.0.8037.57 contains a remote code execution caused by improper free of non-heap memory in Fonts, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-95310 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free caused by improper memory handling in AdFilter, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-95299 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free vulnerability in GPU, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-95284 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.57 contains a buffer overflow in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-95283 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.57 contains a buffer overflow caused by improper handling in Tint component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-95281 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.57 contains a buffer overflow in ANGLE caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-95277 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free caused by improper memory handling in Views, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.8 /10 Critical
    CVE-2026-94952 No auth

    TOTOLINK N150RT - Buffer Overflow

    TOTOLINK N150RT firmware V3.4.0-B20201030 contains a buffer overflow caused by improper handling of ip_subnet and fw_ip parameters in /boafrm/formPortFw, letting remote attackers cause memory corruption, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-91048 No auth

    Apache Karaf - Privilege Escalation & Remote Code Execution

    Apache Karaf contains a privilege escalation to remote code execution caused by lack of ACL rules for jdbc:* and jms:* shell commands, letting authenticated users with viewer role execute arbitrary code via crafted JDBC URLs, exploit requires authenticated shell session with viewer role.