Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 59 of 125

  • 9.1 /10 Critical
    CVE-2026-102792 Auth required

    Ziroom ZHOME A0101 - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the conloglevel/log_size arguments in /api/ZRnetwork/set_syslog, letting remote attackers execute arbitrary commands, exploit requires crafted request.

  • 10.0 /10 Critical
    CVE-2026-102425 PoC publicNo auth

    Balbooa Forms - Remote Code Execution

    Balbooa Forms < 2.4.3.4 contains an unauthenticated remote code execution caused by improper sanitization of field shortcodes in administrator-defined PHP code after public form submission, letting remote attackers execute arbitrary code, exploit requires a public form with PHP-after-submission action using attacker-controlled shortcodes.

  • 9.1 /10 Critical
    CVE-2026-102361 No auth

    mall4j - Authentication Bypass

    mall4j through 4.0 contains a broken authentication vulnerability caused by missing authentication in the PUT /user/updatePwd endpoint, letting unauthenticated attackers reset any storefront account password, exploit requires no authentication.

  • 9.6 /10 Critical
    CVE-2026-102331 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.92 contains a buffer overflow in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-102316 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.92 contains a use after free vulnerability in Views, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-102309 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.92 contains a use after free vulnerability in FullScreen, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-102308 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.92 contains a use after free vulnerability in Views, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-102306 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.92 contains a use after free vulnerability in Bluetooth, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-102304 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.92 contains a use after free vulnerability in Passwords, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 10.0 /10 Critical
    CVE-2026-102240 No auth

    Netcore NAP930 - Command Injection

    Netcore NAP930 0.1.241010.141410 contains a command injection caused by manipulation of the "sid" argument in /www/cgi-bin/network_tools Network Tools CGI, letting remote attackers execute OS commands, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-101354 No auth

    FAST FAC1203R - Buffer Overflow

    FAST FAC1203R 20200116_2.0.4 contains a stack-based buffer overflow caused by manipulation in _tWlanTask function of MmtAtePrase Parser, letting local network attackers execute code, exploit requires local network access.

  • 9.1 /10 Critical
    CVE-2026-101264 Auth required

    Ziroom ZHOME A0101 - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "password1" argument in /api/ZRnetwork/set_passwd, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-101263 Auth required

    Ziroom ZHOME A0101 - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "mac" argument in /api/ZRQos/set_online_client, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.4 /10 Critical
    CVE-2026-101127 No auth

    Joomla Balbooa Forms - Stored XSS

    Balbooa Forms < 2.4.3.4 contains a stored XSS caused by storing attacker-supplied original multipart filename verbatim in submission attachments, letting unauthenticated attackers execute script when admin views submission, exploit requires admin to open submission.

  • 9.6 /10 Critical
    CVE-2026-100829 No auth

    Firefox ESR - Mitigation Bypass

    Firefox ESR contains a mitigation bypass caused by a flaw in the DOM security component, letting attackers bypass security mitigations, exploit requires no special conditions.