Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 64 of 125
- 9.8 /10 CriticalCVE-2026-88777 No auth
Citrix NetScaler ADC & Gateway - Buffer Overflow
Citrix NetScaler ADC and Gateway before 14.1-73.37 and 13.1-64.23 contain a buffer overflow caused by improper memory handling, letting attackers cause denial of service or unpredictable behavior, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-88776 PoC publicNo auth
Citrix NetScaler ADC & Gateway - Buffer Overflow
Citrix NetScaler ADC and Gateway before 14.1-73.37 and 13.1-64.23 contain a buffer overflow caused by improper memory handling, letting attackers cause denial of service or unpredictable behavior, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-88775 No auth
Citrix NetScaler ADC & Gateway - Buffer Overflow
Citrix NetScaler ADC and Gateway before 14.1-73.37 and 13.1-64.23 contain a buffer overflow caused by improper memory handling, letting attackers cause denial of service or unpredictable behavior, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-88773 PoC publicNo auth
Citrix NetScaler ADC & Gateway - HTTP Request Smuggling
Citrix NetScaler ADC and Gateway before 14.1-73.37 and 13.1-64.23 contain an HTTP request smuggling vulnerability caused by inconsistent interpretation of HTTP requests, letting attackers perform request smuggling attacks, exploit requires crafted HTTP requests.
- 9.8 /10 CriticalCVE-2026-88771 CISA KEVPoC publicNo auth
Citrix NetScaler ADC & Gateway - Command Injection
Citrix NetScaler ADC and Gateway < 14.1-73.37, < 13.1-64.23 contain a command injection caused by improper input validation, letting unauthenticated attackers execute arbitrary commands remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-101090
Nezha - Host Header Injection
Nezha 2.2.3 contains a host header injection caused by reflecting attacker-supplied HTTP Host header in OAuth2 redirect_uri when dashboard_host is empty, letting attackers hijack OAuth2 login flow, exploit requires empty dashboard_host configuration.
- 9.6 /10 CriticalCVE-2026-101084 Auth required
Obot - Broken Access Control
Obot < v0.21.1 contains a broken access control vulnerability caused by failure to enforce access control rules on /mcp-connect endpoint, letting authenticated users bypass authorization to access restricted MCP servers using server ID.
- 9.8 /10 CriticalCVE-2026-101065 No auth
Obot - Authentication Bypass
Obot up to commit d7e6970 contains an authentication bypass caused by disabled authentication in the Docker quickstart, letting unauthenticated attackers gain full admin access and control over the host Docker, exploit requires exposed port with disabled authentication.
- 10.0 /10 CriticalCVE-2026-100886 PoC publicNo auth
Seetong T8108 - Authentication Bypass
Seetong T8108, T8108P, T8116, and T8232 4.6.1.4-build202604241011 contain an authentication bypass caused by improper authentication in Debug Service, letting remote attackers bypass authentication, exploit requires no special privileges.
- 9.6 /10 CriticalCVE-2026-100833 PoC publicAuth required
Contrast - Broken Access Control
Contrast (edgelesssys/contrast) < 1.23.1 contains a broken access control vulnerability caused by an improper allow_storage rule in runtime policies, letting attackers with Kata agent API access substitute container images, exploit requires attacker access to Kata agent API.
- 9.8 /10 CriticalCVE-2026-100741 No auth
Progressive Robot Ltd hMailServer - Command Injection
Progressive Robot Ltd hMailServer 6.0.0 through 6.3.3 on Windows contains a command injection caused by improper escaping of backslash in JScript event-script dispatcher, letting remote unauthenticated attackers execute arbitrary JScript with service account privileges, exploit requires event scripting enabled, JScript language, and specific event handlers defined.
- 9.9 /10 CriticalCVE-2026-100740 PoC publicAuth required
D-Link DIR-895L - Buffer Overflow
D-Link DIR-895L A1_102b07 contains a buffer overflow caused by out-of-bounds write in tunnel_set_params function of L2TP Control Channel Parser, letting remote attackers cause denial of service or code execution, exploit requires crafted network packets.
- 9.0 /10 CriticalCVE-2026-100721 PoC publicNo auth
vm2 - Authorization Bypass
vm2 before 3.12.2 contains an authorization bypass caused by improper external-module resolution in NodeVM, letting untrusted guest code execute arbitrary code in the host context, exploit requires custom external resolver with context 'host'.
- 10.0 /10 CriticalCVE-2026-97163 PoC publicNo auth
Joomla Extension lomart.fr - Remote Code Execution
Joomla Extension lomart.fr UP plugin 5.0.0-5.2.0, 6.0.0-6.0.29 contains an unauthenticated remote code installation vulnerability caused by improper validation, letting unauthenticated attackers install remote code.
- 9.2 /10 CriticalCVE-2026-97161 PoC publicNo auth
Joomla Extension lomart.fr - Path Traversal
Joomla Extension lomart.fr UP plugin 5.0.0-5.2.0, 6.0.0-6.0.29 contains path traversal vulnerabilities caused by improper input validation, letting attackers access arbitrary files remotely, exploit requires crafted requests.