Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 79 of 166

  • 9.3 /10 Critical
    CVE-2026-85153 No auth

    Schmooze - Authentication Bypass

    Schmooze app contains hardcoded credentials and cryptographic keys in the client application, letting unauthenticated remote attackers gain unauthorized access and forge client requests by extracting embedded secrets.

  • 9.8 /10 Critical
    CVE-2026-82989 No auth

    ViewSonic ViewBoard - Input Injection

    ViewSonic ViewBoard contains an input injection caused by improper input validation in exposed network service endpoints, letting remote unauthenticated attackers inject arbitrary input via HTTP requests.

  • 9.8 /10 Critical
    CVE-2026-79805 No auth

    ClearPass Policy Manager - Path Traversal

    ClearPass Policy Manager contains a path traversal caused by authenticated access, letting attackers read and modify certain files on the underlying operating system, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-79801 No auth

    HPE Networking ClearPass Policy Manager - Remote Code Execution

    HPE Networking ClearPass Policy Manager client agent contains a missing integrity verification vulnerability, letting unauthenticated remote attackers execute arbitrary code, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-79798 Auth required

    ClearPass Policy Manager - SQL Injection

    ClearPass Policy Manager contains a SQL injection caused by improper input sanitization in the web-based management interface, letting low-privileged authenticated remote attackers execute arbitrary database commands.

  • 9.8 /10 Critical
    CVE-2026-79796 No auth

    ClearPass Policy Manager - Authentication Bypass

    ClearPass Policy Manager contains an authentication bypass vulnerability caused by flaws in the affected interface, letting unauthenticated remote attackers gain unauthorized access, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-79794 Auth required

    ClearPass Policy Manager - SQL Injection

    ClearPass Policy Manager contains a sql injection caused by improper input sanitization in the web-based management interface, letting authenticated remote attackers execute arbitrary database commands.

  • 9.1 /10 Critical
    CVE-2026-77178 No auth

    Oracle VM VirtualBox - Out of Bounds Write

    Oracle VM VirtualBox < 7.2.8 contains an out-of-bounds write caused by improper handling in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet network device model, letting guest OS users cause memory corruption on the host OS, exploit requires guest OS access.

  • 9.8 /10 Critical
    CVE-2026-76754 No auth

    ClearPass Policy Manager - SQL Injection

    ClearPass Policy Manager contains a sql injection caused by improper input sanitization in an affected interface, letting unauthenticated remote attackers execute arbitrary database commands, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-76753 No auth

    HPE Networking ClearPass Policy Manager - Remote Code Execution

    HPE Networking ClearPass Policy Manager contains a format string vulnerability in a service interface, letting unauthenticated remote attackers corrupt process memory and execute arbitrary code, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-76752 No auth

    HPE Networking ClearPass Policy Manager - Authentication Bypass

    HPE Networking ClearPass Policy Manager contains an authentication bypass caused by flaws in web-based management and API interfaces, letting unauthenticated remote attackers gain administrative access, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-76751 No auth

    ClearPass Policy Manager OnGuard - Remote Code Execution

    ClearPass Policy Manager OnGuard agent contains a missing integrity verification vulnerability, letting unauthenticated remote attackers execute arbitrary code with elevated agent privileges, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-76750 No auth

    HPE Networking ClearPass Policy Manager - Insecure Deserialization

    HPE Networking ClearPass Policy Manager contains an insecure deserialization vulnerability in the web interface, letting unauthenticated remote attackers execute arbitrary code.

  • 9.1 /10 Critical
    CVE-2026-76747 No auth

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow caused by improper input handling in an affected interface, letting unauthenticated remote attackers expose sensitive memory and cause denial of service, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-76746

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow vulnerability allowing unauthenticated adjacent attackers to expose sensitive memory contents and cause denial of service, exploit requires attacker to be adjacent.