Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 82 of 166

  • 9.8 /10 Critical
    CVE-2026-106511 No auth

    MultiversX multisig-improved - Broken Access Control

    MultiversX multisig-improved contains a broken access control vulnerability caused by missing independent authorization checks, letting attackers with Proposer role move funds alone, exploit requires Proposer role.

  • 9.6 /10 Critical
    CVE-2026-106501 Auth required

    Backstage @backstage/plugin-scaffolder-backend - Information Disclosure

    Backstage @backstage/plugin-scaffolder-backend < 3.3.1, < 3.4.1, < 4.0.3, < 4.1.0 contains a sensitive information exposure caused by unauthorized access to another user's Scaffolder task data, letting authenticated users disclose internal execution data including credentials, exploit requires user authentication.

  • 9.8 /10 Critical
    CVE-2026-106446 No auth

    Handlebars - Server-Side Template Injection

    Handlebars 4.0.0 to < 4.7.10 contains a server-side template injection caused by insufficient AST validation in Handlebars.compile() and Handlebars.precompile(), letting attackers execute arbitrary code by supplying crafted AST objects, exploit requires attacker to supply an object instead of a template string.

  • 9.2 /10 Critical
    CVE-2026-106445 PoC publicNo auth

    Handlebars - Server-Side Template Injection

    Handlebars 4.0.0 to 4.7.10 contains a server-side template injection caused by lookupProperty returning Function.prototype.constructor before applying prototype-access deny list, letting attackers execute arbitrary JavaScript with server privileges, exploit requires allowProtoMethodsByDefault enabled and accessible function in template context.

  • 9.6 /10 Critical
    CVE-2026-106419 No auth

    Google Chrome - Use After Free

    Google Chrome on Android < 155.0.8059.39 contains a use after free vulnerability in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-106417 No auth

    Google Chrome - Integer Overflow

    Google Chrome < 155.0.8059.39 contains an integer overflow in Media component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-106414 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on iOS < 155.0.8059.39 contains a remote code execution vulnerability caused by improper input validation in Mobile component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires social engineering.

  • 9.6 /10 Critical
    CVE-2026-106401 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.39 contains an out of bounds write vulnerability in Media, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-106382 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.39 contains a use after free caused by improper memory handling in Chromecast component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-106375 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.39 contains a remote code execution caused by incomplete cleanup in Dawn component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-106372 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 155.0.8059.39 contains a broken access control caused by incorrect authorization in UI, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-106358 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.39 contains a use after free vulnerability in Navigation, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-106329 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 155.0.8059.39 contains a broken access control vulnerability caused by incorrect authorization in FileSystem, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires social engineering.

  • 9.6 /10 Critical
    CVE-2026-106323 No auth

    Google Chrome - Authentication Bypass

    Google Chrome on iOS < 155.0.8059.39 contains a missing authorization vulnerability caused by lack of proper access control, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires social engineering.

  • 9.6 /10 Critical
    CVE-2026-106298 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.39 contains a use after free vulnerability in Chrome Tabs, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.