Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 74 of 125

  • 9.1 /10 Critical
    CVE-2026-75728 No auth

    Adobe Campaign Classic - Authentication Bypass

    Adobe Campaign Classic contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75723 No auth

    Adobe Campaign Classic - Authentication Bypass

    Adobe Campaign Classic contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75721 No auth

    Adobe Campaign Classic - Command Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75703 No auth

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75699 No auth

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.3 /10 Critical
    CVE-2026-75698 No auth

    Adobe Connect - Reflected XSS

    Adobe Connect contains a reflected XSS caused by improper input sanitization, letting attackers inject malicious scripts to gain elevated access or control, exploit requires victim interaction with crafted URL or page.

  • 9.3 /10 Critical
    CVE-2026-75697 No auth

    Adobe Connect - Stored XSS

    Adobe Connect contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the malicious page.

  • 9.3 /10 Critical
    CVE-2026-75689 No auth

    Adobe Connect - Stored XSS

    Adobe Connect contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the malicious page.

  • 9.3 /10 Critical
    CVE-2026-75686 No auth

    Adobe Connect - Remote Code Execution

    Adobe Connect contains an improper input validation vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires victim interaction with a malicious URL or web page.

  • 9.3 /10 Critical
    CVE-2026-75684 No auth

    Adobe Connect - Stored XSS

    Adobe Connect contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the malicious page.

  • 9.9 /10 Critical
    CVE-2026-75682 Auth required

    Adobe Connect - SQL Injection

    Adobe Connect contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers execute arbitrary SQL commands and potentially escalate privileges, exploit requires no user interaction.

  • 9.8 /10 Critical
    CVE-2026-74849 No auth

    Zohocorp ManageEngine ADSelfService Plus - Remote Code Execution

    Zohocorp ManageEngine ADSelfService Plus < 7001 contains a remote code execution vulnerability caused by an issue in the GINA client, letting remote attackers execute arbitrary code, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-73369 No auth

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.8 /10 Critical
    CVE-2026-65113 No auth

    NVIDIA Infrastructure Controller for Linux - Hardcoded Credentials

    NVIDIA Infrastructure Controller for Linux contains a hardcoded credentials vulnerability caused by use of hard-coded credentials, letting attackers escalate privileges, tamper data, cause denial of service, and disclose information, exploit requires no special conditions.

  • 9.9 /10 Critical
    CVE-2026-57149 Auth required

    Plone plone.app.portlets.portlets - Server-Side Template Injection

    Plone plone.app.portlets.portlets 5.0.0 to <5.0.8, <6.0.4, and <7.0.2 contains a code execution vulnerability caused by unsafe evaluation of user-supplied TALES expressions in the Classic portlet template, letting authenticated users execute arbitrary code, exploit requires ability to add or edit Classic portlets.