Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 60 of 166

  • 9.6 /10 Critical
    CVE-2026-104192 No auth

    Dragonfly - Use After Free

    Dragonfly < 1.40 contains a double-free vulnerability caused by improper cleanup of shared objects in OpaqueObjLoader::CreateStream, letting unauthenticated clients cause denial of service or remote code execution via crafted RESTORE streams.

  • 9.3 /10 Critical
    CVE-2026-103928 No auth

    Metabase - File System Read & Write

    Metabase 1.55.0 to 1.58.16, 1.59.13, 1.60.9, and 1.61.4 contains a file system read and write vulnerability caused by unrestricted host-facing built-in functions in native queries against H2 data source, letting authorized users read or write arbitrary files on the server, exploit requires user authorization to run native queries.

  • 10.0 /10 Critical
    CVE-2026-103849 No auth

    Adobe Commerce - Template Injection

    Adobe Commerce contains a template injection caused by improper neutralization of special elements in the template engine, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.9 /10 Critical
    CVE-2026-103848 Auth required

    Adobe Experience Manager - OS Command Injection

    Adobe Experience Manager contains an OS command injection caused by improper neutralization of special elements, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.3 /10 Critical
    CVE-2026-102989 No auth

    TanStack Router - Stored XSS

    TanStack Router versions @tanstack/start-server-core 1.143.12 to <1.169.39, @tanstack/react-start <1.168.60, @tanstack/solid-start <1.168.57, and @tanstack/vue-start <1.168.56 contain a stored XSS caused by attacker-controlled middleware state reaching error path, letting unauthenticated attackers inject scripts that execute with visitor's authority, exploit requires crafted server-function URL.

  • 9.6 /10 Critical
    CVE-2026-102238 No auth

    Visual Studio Code - Path Traversal

    Visual Studio Code contains a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory, letting unauthorized attackers execute code over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-102210 No auth

    Windows Text Shaping - Remote Code Execution

    Windows Text Shaping contains a heap-based buffer overflow, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-100222 No auth

    Network Policy Server - Remote Code Execution

    Network Policy Server contains a heap-based buffer overflow allowing unauthorized attackers to execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-100219 No auth

    Microsoft QUIC - Remote Code Execution

    Microsoft QUIC contains a use after free vulnerability that allows unauthorized attackers to execute code over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-100202 No auth

    Windows Message Queuing Queue Manager - Remote Code Execution

    Windows Message Queuing Queue Manager contains a use after free vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-100133 No auth

    Adobe Commerce - Stored XSS

    Adobe Commerce contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the vulnerable page.

  • 9.1 /10 Critical
    CVE-2024-34324

    ProPhoenix Law RMS - Authentication Bypass

    ProPhoenix Law RMS v2022.2403.3.101 contains a session hijacking vulnerability caused by injection of a crafted 24-character string into the ASP.NET_SessionId cookie, letting attackers hijack user sessions, exploit requires crafted cookie injection.

  • 10.0 /10 Critical
    CVE-2024-34323 No auth

    ProPhoenix Law RMS - Insecure Direct Object Reference

    ProPhoenix Law RMS v2022.2403.3.101 contains an insecure direct object reference caused by improper access control on the usrLogin$hdnPFID parameter, letting attackers access sensitive information via crafted HTTP requests.

  • 9.8 /10 Critical
    CVE-2024-34320

    ProPhoenix Law RMS - Broken Access Control

    ProPhoenix Law RMS v2022.2403.3.101 contains an incorrect access control issue in sensitive API endpoints, letting attackers bypass authorization, exploit requires access to the API endpoints.

  • 9.9 /10 Critical
    CVE-2026-96012 Auth required

    IBM Db2 Mirror for i - Privilege Escalation

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 contains a privilege escalation vulnerability caused by bypassing authorization and input validation checks via crafted requests, letting authenticated attackers execute malicious code and elevate privileges.