Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 81 of 125

  • 9.9 /10 Critical
    CVE-2026-61781 Auth required

    pg_partman - Command Injection

    pg_partman prior to 5.5.0 contains a command injection caused by unquoted interpolation of part_config.time_encoder in create_partition_time(), letting roles with partman_user INSERT/UPDATE privileges execute arbitrary SQL with superuser privileges, exploit requires partman_user role privileges.

  • 9.9 /10 Critical
    CVE-2026-61682 Auth required

    kcp - Broken Access Control

    kcp < 0.31.4 and < 0.32.2 contains a broken access control vulnerability caused by front-proxy not removing inbound identity headers, letting authenticated tenants impersonate identities and bypass authorization, exploit requires tenant authentication.

  • 9.8 /10 Critical
    CVE-2026-61550

    Icinga 2 - Authentication Bypass

    Icinga 2 2.8 to 2.14.9, 2.15.4, and 2.16.2 contains a broken authentication caused by lack of validation of sender in certificate update JSON-RPC message handling, letting unauthenticated network attackers impersonate trusted nodes and take control, exploit requires network access to TCP port 5665.

  • 9.1 /10 Critical
    CVE-2026-59163

    Mnemosyne - Authentication Bypass

    Mnemosyne < 3.10.1 contains a broken authentication caused by disabled JWT signature verification in sync_server.py, letting attackers bypass authentication with any well-formed token, exploit requires network access to the sync server endpoint.

  • 9.8 /10 Critical
    CVE-2026-58264 No auth

    FluidSynth - Buffer Overflow

    FluidSynth 1.1.2 to 2.5.6 contains a buffer overflow caused by lack of bounds checking on the pitch_bend_range command channel argument in the command handler, letting remote or local attackers cause denial of service or execute code, exploit requires use of TCP server or command shell.

  • 9.8 /10 Critical
    CVE-2026-13684 No auth

    Synology DiskStation Manager - Improper Output Encoding

    Synology DiskStation Manager (DSM) < 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 contains an improper encoding or escaping of output vulnerability in SCGI, letting remote attackers read or write arbitrary files and cause denial-of-service, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-13639 No auth

    Synology DiskStation Manager - Insufficient Entropy Vulnerability

    Synology DiskStation Manager (DSM) < 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 contains an insufficient entropy vulnerability in login logic, letting remote attackers read or write arbitrary files and cause denial of service, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-10858 Auth required

    IBM MQ for HPE NonStop - Buffer Overflow

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 contains a buffer underflow caused by improper processing of multi-segment messages, letting authenticated attackers cause denial of service or execute arbitrary code.

  • 10.0 /10 Critical
    CVE-2026-10747 No auth

    IBM MQ Appliance - Buffer Overflow

    IBM MQ Appliance contains a heap buffer overflow in protocol message processing before authentication, letting remote attackers cause denial of service or execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2025-66455 No auth

    LMDeploy - Remote Code Execution

    LMDeploy 0.9.2 to < 0.16.0 contains a remote code execution caused by unsafe Python pickle deserialization in PyTorch DistServe control plane, letting unauthenticated attackers execute arbitrary code remotely via crafted payloads.

  • 9.9 /10 Critical
    CVE-2025-53837 Auth required

    XWiki Rendering - Remote Code Execution

    XWiki Rendering < 14.10.2 and < 15.0 RC1 contains a remote code execution caused by unescaped rendering output in HTML macros, letting users with edit rights execute arbitrary script macros with programming rights, exploit requires edit access to user profile or documents.

  • 10.0 /10 Critical
    CVE-2025-15399 No auth

    IBM Common Licensing Agent - Cross-Site Request Forgery

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 contain a cross-site request forgery vulnerability caused by lack of proper request validation, letting attackers execute unauthorized actions via trusted user sessions, exploit requires victim user interaction.

  • 9.8 /10 Critical
    CVE-2023-54399 CISA KEVNo auth

    Hongjing e-HR - SQL Injection

    Hongjing e-HR < 8.2 contains a SQL injection caused by unsanitized 'categories' parameter in /servlet/codesettree after HRMS-encoding is stripped, letting unauthenticated remote attackers read arbitrary database content.

  • 9.6 /10 Critical
    CVE-2026-93374 No auth

    Google Chrome - Use After Free

    Google Chrome on Android < 153.0.8010.52 contains a use after free vulnerability in Dawn, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-93373 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.52 contains a use after free vulnerability in Extensions, letting remote attackers execute arbitrary code outside the sandbox via crafted extensions.