Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 57 of 166

  • 9.1 /10 Critical
    CVE-2026-52394 No auth

    DeepSeek - Broken Access Control

    DeepSeek V4 contains an incorrect access control vulnerability caused by crafted input, letting attackers bypass access restrictions, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-49950 No auth

    Xorbits Xoscar - Remote Code Execution

    Xorbits Xoscar <= 0.11.2 contains an insecure deserialization vulnerability caused by unvalidated data passed to cloudpickle.loads() in actor-pool TCP channel, letting remote attackers execute arbitrary code as server process, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-48383 No auth

    Adobe Experience Manager - Broken Access Control

    Adobe Experience Manager contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, potentially gaining elevated access, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-48382 No auth

    Adobe Experience Manager - Broken Access Control

    Adobe Experience Manager contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, potentially gaining elevated access, exploit requires no user interaction.

  • 9.1 /10 Critical
    CVE-2026-44415 Auth required

    Affected Systems - Broken Access Control

    Affected systems contain a broken access control vulnerability caused by improper restriction of internal APIs and paths, letting authenticated remote attackers access sensitive information and potentially delete data, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-37107 PoC publicNo auth

    HTMLy - Privilege Escalation

    HTMLy 3.1.1 contains a privilege escalation caused by improper access control in the get_feed function of admin.php, letting remote attackers escalate privileges, exploit requires remote access.

  • 9.6 /10 Critical
    CVE-2026-110165 No auth

    Google Chrome - Use After Free

    Google Chrome on Android < 155.0.8059.79 contains a use after free vulnerability in Core, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-110161 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free caused by improper memory handling in network component, letting remote attackers execute arbitrary code outside the sandbox via crafted network traffic.

  • 9.6 /10 Critical
    CVE-2026-110159 No auth

    Google Chrome - Authorization Bypass

    Google Chrome < 155.0.8059.79 contains an authorization bypass caused by incorrect authorization in Updater, letting local attackers execute arbitrary code outside the sandbox via a local program, exploit requires local access.

  • 9.6 /10 Critical
    CVE-2026-110152 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 155.0.8059.79 contains a buffer overflow in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-110149 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free vulnerability in the browser, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-110142 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free caused by improper memory handling in FileSystem, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-110136 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free vulnerability in PDF component caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 10.0 /10 Critical
    CVE-2026-110130 No auth

    Dockhand - Authentication Bypass

    Dockhand < 1.0.45 contains an authentication bypass caused by global auth hook skipping authentication for static-asset extensions and user-mutation handlers failing open, letting unauthenticated remote attackers reset user passwords via crafted PUT requests.

  • 9.1 /10 Critical
    CVE-2026-110116 No auth

    Risesoft-y9 Digital-Infrastructure - Path Traversal

    Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability caused by crafted fullPath and fileName parameters in the fileManager storeFile endpoint, letting unauthenticated attackers write arbitrary files and potentially execute code.