Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 59 of 166
- 9.6 /10 CriticalCVE-2026-106620 Auth required
ColdFusion - Broken Access Control
ColdFusion contains an incorrect authorization vulnerability caused by flawed access control, letting low-privileged attackers bypass security measures and gain unauthorized write access, exploit requires no user interaction.
- 9.0 /10 CriticalCVE-2026-106619 No auth
ColdFusion - Improper Input Validation
ColdFusion contains an improper input validation vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires conditions beyond attacker control.
- 9.9 /10 CriticalCVE-2026-106612 Auth required
ColdFusion - Broken Access Control
ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 9.8 /10 CriticalCVE-2026-106173 No auth
Fortinet FortiSIEM - Path Traversal
Fortinet FortiSIEM 7.5.0 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting attackers execute unauthorized code or commands via specially crafted packets, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-106042 Auth required
Ivanti Xtraction - Broken Access Control
Ivanti Xtraction < 2026.4 contains an external control of file name or path vulnerability caused by improper validation of application-generated request destinations, letting remote authenticated attackers redirect requests and obtain EPMM connector credentials.
- 9.9 /10 CriticalCVE-2026-105903 Auth required
ColdFusion - Code Injection
ColdFusion contains a code injection vulnerability caused by improper control of code generation, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 10.0 /10 CriticalCVE-2026-105899 No auth
ColdFusion - Unrestricted File Upload
ColdFusion contains an unrestricted file upload vulnerability allowing dangerous file types, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 9.9 /10 CriticalCVE-2026-105895 Auth required
Adobe Experience Manager - Improper Input Validation
Adobe Experience Manager contains an improper input validation vulnerability that allows attackers to execute arbitrary code in the context of the current user, potentially gaining elevated access, exploit requires no user interaction.
- 9.4 /10 CriticalCVE-2026-105445 Auth required
Docker Hub - Broken Access Control
Docker Hub contains an incorrect privilege assignment caused by improper handling of personal access token reassignment in account-to-organization conversion, letting authenticated attackers reassign tokens to other users, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-105016 No auth
Microsoft QUIC - Remote Code Execution
Microsoft QUIC contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-105010 No auth
Microsoft Windows Search Component - Privilege Escalation
Microsoft Windows Search Component contains a use after free vulnerability allowing unauthorized attackers to elevate privileges over a network, exploit requires network access.
- 9.0 /10 CriticalCVE-2026-105008 No auth
Windows Schannel - Spoofing
Windows Schannel contains a spoofing vulnerability caused by improper authentication handling, letting unauthorized attackers impersonate entities over a network, exploit requires network access.
- 8.6 /10 CriticalCVE-2026-104935 CISA KEVPoC publicNo auth
ICS - Authentication Bypass
ICS < 25.1.3.0 contains an authentication bypass by spoofing, letting remote unauthenticated attackers execute arbitrary commands, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-104585 PoC publicNo auth
Mobile Security Framework (MobSF) - Command Injection
Mobile Security Framework (MobSF) v4.5.2 contains a command injection caused by improper input handling in /download_data/, /api/v1/scan, and Dynamic Analyzer ADB integration module, letting attackers execute arbitrary commands remotely, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-104252 No auth
Vitess - Stored XSS
Vitess < 23.0.5 and < 24.0.2 contains a stored XSS caused by unescaped Action and dtid form values in the /twopcz HTTP debug endpoint, letting remote unauthenticated attackers execute scripts in operator browsers, exploit requires operator to open crafted request.