Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 72 of 166

  • 9.8 /10 Critical
    CVE-2026-87684 No auth

    Brocade Fabric - Buffer Overflow

    Brocade Fabric < 10.0.1 contains a stack-based buffer overflow caused by improper length validation of user-supplied context name in SNMP daemon request handling, letting remote unauthenticated attackers cause memory corruption, DoS, or code execution.

  • 9.8 /10 Critical
    CVE-2026-87659

    Brocade Fabric OS - Authorization Bypass

    Brocade Fabric OS < 10.0.1 contains an authorization bypass caused by crafted inband Fibre Channel vendor-unique CT management requests in Management Server, letting compromised peer switches perform administrative actions, exploit requires compromised switch connected to fabric.

  • 9.8 /10 Critical
    CVE-2026-85097 CISA KEVPoC publicNo auth

    Bricksforge WordPress - Unrestricted File Upload

    Bricksforge WordPress plugin <= 3.1.8.9 contains an unrestricted file upload vulnerability caused by insufficient validation of the 'temporaryFileUploads' URL field, letting unauthenticated attackers upload and execute arbitrary PHP code.

  • 9.8 /10 Critical
    CVE-2026-84272 No auth

    IBM Guardium Data Protection - Authentication Bypass

    IBM Guardium Data Protection 12.1 and 12.2.2 contain a missing authentication vulnerability in the edge-controller component, letting unauthenticated remote attackers execute arbitrary container images and control managed edge clusters.

  • 9.8 /10 Critical
    CVE-2026-84249 No auth

    IBM Guardium Data Protection - Authentication Bypass

    IBM Guardium Data Protection 12.2 and 12.2.2 contain an authentication bypass caused by missing authentication for critical management functions, letting remote attackers execute arbitrary management operations, exploit requires no special privileges.

  • 9.3 /10 Critical
    CVE-2026-84244 No auth

    IBM Guardium Data Protection - Stored XSS

    IBM Guardium Data Protection 12.2 contains a stored cross-site scripting caused by improper sanitization in the Quick Search results grid, letting unauthenticated attackers execute malicious scripts in authenticated users' browsers, exploit requires influencing monitored database traffic.

  • 9.8 /10 Critical
    CVE-2026-80381 No auth

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a sql injection caused by improper input sanitization, letting remote attackers execute unauthorized SQL statements, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-79842 No auth

    HPE Intelligent Management Center - Authentication Bypass

    HPE Intelligent Management Center (iMC) < 7.3 E0713 contains an authentication bypass caused by improper authentication checks, letting attackers gain unauthorized access, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-78663 No auth

    HTTP/2 Server - Denial of Service

    HTTP/2 server contains a flow control bypass caused by double refunding connection-level flow control for the same data, letting malicious clients bypass connection-level flow control limits, exploit requires malicious client to reset streams.

  • 9.8 /10 Critical
    CVE-2026-78406 No auth

    IBM Security Verify Access & IBM Verify Identity Access - Remote Code Execution

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote unauthenticated attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-78401 No auth

    IBM Security Verify Access & IBM Verify Identity Access - Remote Code Execution

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote unauthenticated attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-77900 No auth

    Azure App Service - Authentication Bypass

    Azure App Service contains a broken authentication caused by missing authentication for a critical function, letting unauthorized attackers execute code remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-75875 No auth

    IBM Guardium Data Protection - Remote Code Execution

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a path traversal vulnerability that allows remote attackers to execute arbitrary code by accessing unintended file paths, exploit requires network access.

  • 9.6 /10 Critical
    CVE-2026-69435 Auth required

    Azure SRE Agent - Broken Access Control

    Azure SRE Agent contains a broken access control vulnerability caused by missing authorization checks, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 9.8 /10 Critical
    CVE-2026-56857 No auth

    Windows - Path Traversal

    Windows file system operations Root.Mkdir and Root.MkdirAll contain a path traversal vulnerability caused by improper handling of junction points, letting attackers create directories outside the root, exploit requires a junction pointing to an empty location.