Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 67 of 125
- 10.0 /10 CriticalCVE-2026-97359 CISA KEVNo auth
HFS2 - Remote Code Execution
HFS2 <= 2.4.0 contains a template injection caused by malicious template syntax in multipart upload filename, letting unauthenticated attackers execute arbitrary commands remotely, exploit requires crafted filename.
- 9.8 /10 CriticalCVE-2026-97230 No auth
IO::Socket::SSL::SelfCertificate - Command Injection
IO::Socket::SSL::SelfCertificate 1.00 for Perl contains a command injection caused by execution of obfuscated Python code from a hardcoded URL in the generate_certificate component, letting attackers execute arbitrary code as the user without saving a script, exploit requires installation of the malicious package.
- 9.8 /10 CriticalCVE-2026-96891 No auth
D-Link DIR-825 - Out of Bounds Read/Write
D-Link DIR-825 3.00b32 contains an out-of-bounds write caused by manipulation of the "peer_hostname" argument in tunnel_set_params function of rp-l2tp component, letting remote attackers corrupt memory, exploit requires crafted input.
- 9.6 /10 CriticalCVE-2026-95699 Auth required
iSteamX - Broken Access Control
iSteamX mobile application prior to 9/18/2026 contains a broken access control caused by AWS policy granting authenticated users access to wildcard MQTT topics, letting authenticated attackers expose user data and control other users' devices, exploit requires user authentication.
- 9.9 /10 CriticalCVE-2026-93577 Auth required
GitLab CE/EE - Remote Code Execution
GitLab CE/EE >= 19.2 and < 19.2.7, >= 19.3 and < 19.3.3, >= 19.4 and < 19.4.1 contains a remote code execution caused by integer overflow when compiling crafted regular expressions in CI/CD configuration, letting authenticated users execute arbitrary code on the server.
- 9.9 /10 CriticalCVE-2026-93425 Auth required
Dokploy - Command Injection
Dokploy < 0.29.13 contains a command injection caused by unsafe argument quoting of user-controlled repoPath in patch.readRepoDirectories tRPC procedure, letting authenticated organization members with service:read permission execute arbitrary commands as root in the container.
- 9.4 /10 CriticalCVE-2026-93291 No auth
Omni C20 - Man-in-the-Middle
Omni C20 contains a man-in-the-middle vulnerability caused by improper certificate validation, letting attackers execute arbitrary code remotely, exploit requires network access to intercept communications.
- 9.1 /10 CriticalCVE-2026-93228 No auth
Linux Kernel - Denial of Service
Linux kernel contains a vulnerability in svcrdma where Write/Reply chunks with segcount 0 are improperly accepted, caused by insufficient validation in xdr_check_write_chunk, letting remote peers send malformed chunks, exploit requires network access to send crafted RDMA packets.
- 9.8 /10 CriticalCVE-2026-93207 No auth
Linux Kernel - Use After Free
Linux kernel contains a memory handling vulnerability in SUNRPC's svcauth_gss_decode_credbody() where partially decoded rpc_gss_wire_cred state can persist across requests, letting attackers cause use-after-free or data corruption, exploit requires crafted RPC requests.
- 9.9 /10 CriticalCVE-2026-89078 Auth required
GitLab - Remote Code Execution
GitLab CE/EE >= 19.2 and < 19.2.7, >= 19.3 and < 19.3.3, >= 19.4 and < 19.4.1 contains a remote code execution caused by a double free issue in regex parsing in CI/CD configuration, letting authenticated users execute arbitrary code on the server.
- 9.8 /10 CriticalCVE-2026-88378 No auth
QuickJS - Out of Bounds Write
QuickJS contains a heap out-of-bounds write caused by improper bounds checking in JS_ReadFunctionTag(), letting attackers cause memory corruption, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-88365 No auth
minimp3 - Integer Overflow
minimp3 contains an integer overflow caused by improper parsing of the APEv2 tag-size field in mp3dec_skip_id3v1(), letting attackers cause memory corruption or crash, exploit requires crafted MP3 files.
- 9.8 /10 CriticalCVE-2026-88351 No auth
MPack - Integer Overflow
MPack 1.1.1 on 32-bit platforms contains an integer overflow caused by improper size calculation in mpack_tree_parse_children() when parsing crafted MessagePack array32 or map32 objects, letting attackers cause heap buffer overflow and denial of service, exploit requires crafted MessagePack data.
- 9.6 /10 CriticalCVE-2026-81549 Auth required
IBM DataStage on Cloud Pak for Data - Information Disclosure
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an information disclosure vulnerability caused by improper validation of the X-Forwarded-Proto header, letting remote authenticated attackers obtain sensitive information.
- 9.1 /10 CriticalCVE-2026-79766 Auth required
Termix - Command Injection
Termix 2.4.1 to 2.5.1 contains a command injection caused by improper sanitization of domain and email values in certbot shell command execution, letting authenticated administrators execute arbitrary OS commands.