Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 82 of 125

  • 9.6 /10 Critical
    CVE-2026-93372 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 153.0.8010.52 contains a buffer overflow in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 10.0 /10 Critical
    CVE-2026-92960 No auth

    vm2 - Sandbox Escape

    vm2 before 3.11.6 contains a sandbox escape caused by failure to restrict access to os and dns builtins under builtin: ['*'] configuration, letting attackers hijack host DNS resolver globally, exploit requires crafted sandbox code.

  • 9.9 /10 Critical
    CVE-2026-92957 Auth required

    vm2 - Command Injection

    vm2 <= 3.11.6 contains a command injection caused by improper normalization of node:-prefixed builtin specifiers in NodeVM require policy, letting sandboxed attackers execute host commands via child_process, exploit requires crafted require policy.

  • 10.0 /10 Critical
    CVE-2026-92956 PoC public

    vm2 - Sandbox Escape

    vm2 3.10.1 through 3.11.6 contains a sandbox escape caused by manipulation of WebAssembly promise rejection and Symbol.species in default new VM() sandbox on Node.js 26, letting attackers gain host Node.js capabilities without special permissions, exploit requires Node.js 26 environment.

  • 10.0 /10 Critical
    CVE-2026-92955 No auth

    vm2 - Sandbox Escape

    vm2 < 3.11.8 contains a sandbox escape vulnerability caused by access to host __proto__ getter/setter through console._stdout and console._stderr in NodeVM, letting attackers execute code with process context, exploit requires crafted input.

  • 10.0 /10 Critical
    CVE-2026-92953 No auth

    vm2 - Prototype Pollution

    vm2 versions >= 3.11.0 and < 3.11.8 contain a prototype pollution caused by failure to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation, letting attackers modify host prototypes affecting typed arrays after VM.run(), exploit requires attacker to run code in sandbox.

  • 9.9 /10 Critical
    CVE-2026-92951 Auth required

    vm2 - Broken Access Control

    vm2 < 3.11.7 contains an incorrect authorization vulnerability caused by non-exact substring matching in the external package allowlist check, letting attackers bypass allowlist and execute unauthorized host packages, exploit requires crafted package names.

  • 9.9 /10 Critical
    CVE-2026-92948

    vm2 - Sandbox Escape

    vm2 versions >= 3.9.6 and <= 3.11.6 contain a sandbox escape caused by a NodeVM builtin allowlist bypass on Node.js 24+, letting attackers execute arbitrary code outside the sandbox, exploit requires explicit allowance of node:test builtin.

  • 10.0 /10 Critical
    CVE-2026-92947 No auth

    vm2 - Information Disclosure & Denial of Service

    vm2 < 3.11.7 contains an information disclosure and denial of service vulnerability caused by exposure of Node's shared Buffer pool to sandboxed code, letting attackers read and write host memory, exploit requires sandboxed code execution.

  • 10.0 /10 Critical
    CVE-2026-92946 No auth

    vm2 - Remote Code Execution

    vm2 < 3.11.7 contains a remote code execution caused by unrestricted NodeVM instantiation via require.external without require.root excluding node_modules, letting sandboxed code execute arbitrary host OS commands.

  • 9.8 /10 Critical
    CVE-2026-92944

    vm2 - Remote Code Execution

    vm2 3.10.2 through 3.11.6 contains a sandbox escape vulnerability caused by a stale PromiseThenLookupChain protector in V8 14.6 affecting Promise.prototype.finally(), letting attackers execute arbitrary code by exploiting async functions with attacker-controlled Symbol.species, exploit requires Node.js 26 environment.

  • 10.0 /10 Critical
    CVE-2026-92941 No auth

    vm2 - Privilege Escalation & Man-in-the-Middle

    vm2 versions > 3.11.3 and < 3.11.7 contain a privilege escalation caused by exposure of the host tls module to NodeVM sandbox code, letting attackers replace process-wide certificate authorities, exploit requires access to allowed tls and url builtins.

  • 10.0 /10 Critical
    CVE-2026-92940 No auth

    vm2 - Information Disclosure & Remote Code Execution

    vm2 3.11.3 through 3.11.6 contains an information disclosure caused by forwarding method calls on https.globalAgent to sandboxed code in NodeVM, letting attackers read sensitive HTTPS request data and issue authenticated requests, exploit requires NodeVM configured to allow require('https').

  • 9.9 /10 Critical
    CVE-2026-92939 Auth required

    vm2 - Sandbox Escape & Remote Code Execution

    vm2 3.11.3 through 3.11.6 contains a sandbox escape caused by exposure of the host Node.js crypto module via a recursive read-only proxy, letting sandboxed JavaScript execute arbitrary native code with host-process authority, exploit requires allowing the crypto builtin.

  • 9.9 /10 Critical
    CVE-2026-92938 Auth required

    vm2 - Remote Code Execution

    vm2 3.11.3 through 3.11.6 contains a native code execution vulnerability caused by improper handling of the node:sqlite module in NodeVM, letting sandboxed code execute arbitrary native code with host privileges, exploit requires builtin: ['*'] or explicit node:sqlite permission.