Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 79 of 125

  • 10.0 /10 Critical
    CVE-2026-93603 No auth

    vm2 - Sandbox Escape

    vm2 <= 3.12.0 contains a sandbox escape caused by improper handling of nullish `this` receiver in the apply trap of its bridge, letting sandboxed code execute arbitrary commands on the host, exploit requires exposure of non-strict host functions.

  • 9.8 /10 Critical
    CVE-2026-93467 No auth

    HGiga OAKlouds - Insecure Deserialization

    HGiga OAKlouds contains an insecure deserialization vulnerability caused by processing maliciously crafted serialized content, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-93019 No auth

    Perl Imager - Denial of Service

    Perl Imager < 1.036 contains a denial of service caused by improper handling of large TGA colour map length in tga_palette_read, letting attackers cause uncatchable process exit by reading crafted TGA files, exploit requires attacker-supplied file input.

  • 9.1 /10 Critical
    CVE-2026-92702 No auth

    Cocos AI - Authentication Bypass

    Cocos AI <= 0.8.2 contains an attestation freshness enforcement bypass caused by missing or empty expected reportData in the intra-handshake attested TLS AMD SEV-SNP verification path, letting attackers supply stale or unrelated evidence, exploit requires omission of expected reportData.

  • 9.1 /10 Critical
    CVE-2026-92701 PoC publicNo auth

    Trusted Execution Environments - Authentication Bypass

    Trusted Execution Environments up to 0.8.2 contain a session-misbinding vulnerability caused by missing freshness value copy in Intel TDX quote validation, letting attackers bind sessions to unintended attestation contexts, exploit requires crafted TDX QuoteV4 Evidence.

  • 9.9 /10 Critical
    CVE-2026-85878 Auth required

    Azure Database for PostgreSQL - Broken Access Control

    Azure Database for PostgreSQL contains a broken access control vulnerability caused by improper authorization, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 9.8 /10 Critical
    CVE-2026-85497

    CareCam CM2507 - Authentication Bypass

    CareCam CM2507 IP cameras contain a broken authentication caused by storing root-account password using a fixed legacy password hash, letting attackers recover credentials offline, exploit requires access to firmware or password database.

  • 9.1 /10 Critical
    CVE-2026-84738 Auth required

    AF Companion WordPress plugin - Unrestricted File Upload

    AF Companion WordPress plugin < 2.2.0 contains an unrestricted file upload vulnerability caused by lack of file type validation in import feature, letting low-privileged store-management users execute remote code.

  • 9.8 /10 Critical
    CVE-2026-84383 PoC publicNo auth

    libheif - Heap Out-of-Bounds Write

    libheif 1.22.0 to < 1.23.2 contains a heap out-of-bounds write caused by improper handling of nested iden and auxl references in Alpha planes during image decoding, letting remote attackers cause memory corruption via crafted files, exploit requires processing a crafted HEIF, HEIC, or AVIF file.

  • 9.8 /10 Critical
    CVE-2026-84082 No auth

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.2 contains a SQL injection caused by improper neutralization of special elements in SQL commands, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-84078 No auth

    IBM Guardium Data Protection - Authentication Bypass

    IBM Guardium Data Protection 12.2 contains a broken authentication caused by missing authentication in LoadBalancerServlet, letting unauthenticated users perform privileged load-balancer operations, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-84075 No auth

    IBM Guardium Data Protection - Authentication Bypass

    IBM Guardium Data Protection 12.2 contains an authentication bypass caused by missing authentication in ChangeTrackerServlet, letting remote attackers bypass security restrictions, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-84073 Auth required

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.2 contains a SQL injection caused by improper neutralization of special elements in SQL commands, letting remote authenticated attackers execute arbitrary SQL commands.

  • 9.9 /10 Critical
    CVE-2026-84064 Auth required

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.2 contains a SQL injection caused by improper neutralization of special elements in SQL commands, letting remote authenticated attackers execute arbitrary SQL commands.

  • 9.0 /10 Critical
    CVE-2026-84031 Auth required

    IBM Guardium Data Protection - Remote Code Execution

    IBM Guardium Data Protection 12.2 contains a remote code execution caused by improper neutralization of input during web page generation, letting remote authenticated attackers execute arbitrary code.