Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 58 of 166

  • 9.3 /10 Critical
    CVE-2026-109758

    Perforce Helix Authentication Service - Authentication Bypass

    Perforce Helix Authentication Service 2022.1 - 2025.2 contains an authentication bypass caused by retaining the default SCIM bearer token in configuration, letting attackers authenticate to SCIM API and perform user/group operations, exploit requires reachable SCIM endpoint and knowledge of default token.

  • 9.6 /10 Critical
    CVE-2026-109707 No auth

    Mozilla Firefox - Sandbox Escape

    Mozilla Firefox < 158 and Firefox ESR < 153.5 contain a use-after-free vulnerability in the Networking component, letting attackers escape sandbox restrictions, exploit requires crafted network interaction.

  • 9.6 /10 Critical
    CVE-2026-109705

    Mozilla Firefox - Use After Free

    Mozilla Firefox < 158 and Firefox ESR < 153.5 contain a use-after-free vulnerability caused by incorrect boundary conditions in the Networking component, letting attackers escape sandbox and bypass site isolation, exploit requires crafted network activity.

  • 9.9 /10 Critical
    CVE-2026-109412 Auth required

    Ivanti Neurons Patch for Intune - Authentication Information Disclosure

    Ivanti Neurons Patch for Intune contains an information disclosure vulnerability caused by an exposed dangerous endpoint, letting remote authenticated attackers leak sensitive authentication information, exploit requires authentication.

  • 9.9 /10 Critical
    CVE-2026-109157 Auth required

    TRENDnet TEW-432BRP - Buffer Overflow

    TRENDnet TEW-432BRP 3.10B20 contains a buffer overflow caused by manipulation of the "Name" argument in /goform/formTcpipSetup, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-109110 No auth

    Wavlink WL-WN592AX6 - Command Injection

    Wavlink WL-WN592AX6 250422 contains a command injection caused by manipulation in the wmapd Daemon system function, letting remote attackers execute arbitrary OS commands, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-109109 No auth

    Wavlink WL-WN530BE1-A - Buffer Overflow

    Wavlink WL-WN530BE1-A 251117 contains a stack-based buffer overflow caused by improper handling of HTTP_COOKIE/X-Cmd argument in /cgi-bin/ExportAllSettings.cgi, letting remote attackers execute code, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-109108 Auth required

    Wavlink WL-WN530BE1-A - Command Injection

    Wavlink WL-WN530BE1-A 251117 contains a command injection caused by manipulation of the "Type" argument in /cgi-bin/uploadVpn.cgi popen function, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-108971 No auth

    D-Link DCS-930L - Authentication Bypass

    D-Link DCS-930L contains a broken authentication caused by improper verification of cryptographic signature in Emergency HTTP Recovery Server's mpfd_decode function, letting remote attackers bypass signature verification, exploit requires crafted firmware argument.

  • 9.3 /10 Critical
    CVE-2026-106630 No auth

    Adobe Experience Manager - Stored XSS

    Adobe Experience Manager contains a stored XSS caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, exploit requires victim to visit the vulnerable page.

  • 9.3 /10 Critical
    CVE-2026-106629 No auth

    Adobe Experience Manager - Stored XSS

    Adobe Experience Manager contains a stored XSS caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, exploit requires victim to visit the vulnerable page.

  • 9.1 /10 Critical
    CVE-2026-106626 Auth required

    Adobe Experience Manager - Remote Code Execution

    Adobe Experience Manager contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires high privileges.

  • 10.0 /10 Critical
    CVE-2026-106624 No auth

    ColdFusion - Code Injection

    ColdFusion contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-106622 No auth

    ColdFusion - Server-Side Request Forgery

    ColdFusion contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.

  • 9.1 /10 Critical
    CVE-2026-106621 No auth

    ColdFusion - Code Injection

    ColdFusion contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.