Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 77 of 166

  • 9.3 /10 Critical
    CVE-2026-59346 PoC publicNo auth

    VMware Workstation & Fusion - Integer Overflow

    VMware Workstation and Fusion 25H2 and 26H1 contain an integer overflow caused by improper handling in VMXNET3 virtual network adapter, letting local attackers with admin privileges on a VM execute code on the host, exploit requires local admin on VM.

  • 9.1 /10 Critical
    CVE-2026-20328 No auth

    Cisco License On-Prem - Authentication Bypass

    Cisco License On-Prem contains a broken authentication caused by improper checks during the password reset process, letting unauthenticated remote attackers reset arbitrary user passwords and gain unauthorized access, exploit requires sending a crafted request to the web interface.

  • 9.3 /10 Critical
    CVE-2026-19572 No auth

    FlexNet Publisher lmadmin - Authentication Bypass

    FlexNet Publisher lmadmin contains an authentication bypass caused by a hardcoded SOAP handler, letting unauthenticated attackers obtain privileged administrator sessions without valid credentials.

  • 9.3 /10 Critical
    CVE-2026-19386 Auth required

    ASUS Router - Buffer Overflow

    ASUS Router contains a stack-based buffer overflow caused by crafted configuration file upload exceeding buffer size, letting authenticated nearby attackers execute arbitrary code.

  • 9.3 /10 Critical
    CVE-2026-14911 No auth

    ASUS Router - Stored XSS

    ASUS router modules contain a stored XSS caused by improper neutralization of input during web page generation, letting remote attackers read DOM information, modify settings, and cause denial of service when an authenticated user visits a crafted URL.

  • 9.4 /10 Critical
    CVE-2026-107282 No auth

    AsyncHttpClient - Information Disclosure

    AsyncHttpClient < 3.0.13 and < 2.16.1 contains a cross-host request replay vulnerability caused by improper update of target request and proxy context, letting attackers cause sensitive data leakage to unintended hosts, exploit requires crafted request triggering replay.

  • 9.4 /10 Critical
    CVE-2026-107206 No auth

    LMCache - Authentication Bypass

    LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server, letting remote unauthenticated attackers access management endpoints and manipulate cache and configuration.

  • 9.8 /10 Critical
    CVE-2026-107204 No auth

    LMCache - Remote Code Execution

    LMCache <= 0.5.5 contains a remote code execution caused by unauthenticated script posting to /run_script endpoint, letting remote attackers execute arbitrary Python code, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-107202 No auth

    h-ui - Command Injection

    h-ui v0.0.25 and below contains a command injection caused by improper validation of the listen configuration field in the administrative API, letting authenticated administrators execute arbitrary OS commands as root, exploit requires administrator authentication.

  • 9.2 /10 Critical
    CVE-2026-107194 No auth

    Sungrow iSolarCloud - Authentication Bypass

    Sungrow iSolarCloud < 2026 contains an authentication bypass caused by improper handling of "login_type":"5" in login requests, letting attackers bypass authentication and take over accounts, exploit requires user email address.

  • 9.3 /10 Critical
    CVE-2026-107104 No auth

    ERP system - Insecure Deserialization

    ERP system contains an insecure deserialization vulnerability caused by unsafe deserialization of user-controlled data, letting unauthenticated remote attackers execute arbitrary code or manipulate data, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-107103 No auth

    ERP system - SQL Injection

    ERP system contains a SQL injection caused by insufficient validation and parameterization of user input in an API endpoint, letting unauthenticated remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-107102 No auth

    ERP system - Authentication Bypass

    ERP system contains an authentication bypass caused by improper validation of payment callback parameters and inadequate authentication controls in API endpoint, letting unauthenticated remote attackers gain unauthorized access to user accounts, exploit requires crafted parameter manipulation.

  • 9.2 /10 Critical
    CVE-2026-105324 No auth

    ADM - HTTP Header Injection

    ADM 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21 contain an HTTP header injection caused by crafted HTTP requests with injected headers via the state parameter in start-page-loader.cgi, letting unauthenticated remote attackers read arbitrary files using X-Sendfile.

  • 9.8 /10 Critical
    CVE-2026-105192 PoC public

    LMCache - Remote Code Execution

    LMCache multiprocess mode contains a remote code execution caused by unauthenticated ZeroMQ ROUTER message deserialization via pickle.loads, letting unauthenticated attackers execute code as the LMCache process user, exploit requires network access to the transport port.