Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 83 of 125
- 10.0 /10 CriticalCVE-2026-92937
vm2 - Remote Code Execution
vm2 3.11.6 contains a sandbox escape caused by improper sanitization of rejected host Promise values in lib/bridge.js, letting remote attackers execute arbitrary code in the host Node.js process, exploit requires exposure of a host-realm Promise to the sandbox.
- 9.0 /10 CriticalCVE-2026-92935 No auth
vm2 - Remote Code Execution
vm2 >= 3.11.4 and <= 3.11.6 contains a sandbox escape vulnerability caused by improper validation of the require option in NodeVM constructor, letting attackers execute arbitrary commands with host privileges by creating an inner NodeVM with elevated builtin allowlist, exploit requires attacker to supply crafted JavaScript with specific NodeVM configuration.
- 9.0 /10 CriticalCVE-2026-92934
vm2 - Sandbox Escape
vm2 < 3.11.8 contains a sandbox escape caused by incomplete Error.cause sanitization in handling revisited host-wrapped AggregateError objects, letting attackers execute remote code and disclose process information, exploit requires crafted exception handling.
- 9.1 /10 CriticalCVE-2026-92860 Auth required
rcourtman Pulse - Improper Input Validation
rcourtman Pulse <= 6.0.4/6.1.0-rc.4 contains an improper input validation vulnerability caused by manipulation of the Username argument in /api/security/quick-setup Quick Security Setup Handler, letting remote attackers potentially exploit the issue.
- 9.8 /10 CriticalCVE-2026-92489 No auth
Linux Kernel - Denial of Service
Linux kernel contains a double-free vulnerability caused by improper skb freeing in xfrm_dev_direct_output(), letting attackers cause denial of service by crashing the kernel, exploit requires packet processing through netfilter.
- 9.8 /10 CriticalCVE-2026-90823 No auth
FatPipe MPVPN, WARP, and IPVPN - Remote Code Execution
FatPipe MPVPN, WARP, and IPVPN appliances 10.1.2r60p100 contain a stack-based buffer overflow caused by unchecked copy in /usr/sbin/auth_user_pass, letting unauthenticated remote attackers execute arbitrary code as root, exploit requires enabled management interface.
- 9.8 /10 CriticalCVE-2026-90822 No auth
FatPipe MPVPN, WARP, and IPVPN - Command Injection
FatPipe MPVPN, WARP, and IPVPN appliances 10.1.2r60p100 contain a command injection caused by improper input handling in the xtremed daemon's AuthFormServlet endpoint, letting unauthenticated remote attackers execute arbitrary root commands, exploit requires enabled management interface.
- 9.1 /10 CriticalCVE-2026-90414 No auth
Linux Kernel IB/isert - Out-of-Bounds Read
Linux kernel IB/isert contains an out-of-bounds read vulnerability caused by accepting PDUs declaring more data than actually received, letting remote initiators cause memory corruption, exploit requires a malicious initiator after login.
- 9.1 /10 CriticalCVE-2026-90413 No auth
Linux Kernel - Out-of-Bounds Read
Linux kernel contains a buffer over-read vulnerability in IB/isert due to accepting login PDUs declaring more data than received, letting remote attackers cause out-of-bounds read, exploit requires crafted login PDUs with mismatched declared length.
- 9.8 /10 CriticalCVE-2026-90235 No auth
Linux Kernel - Race Condition
Linux kernel contains a race condition in sunrpc xprtsock caused by improper synchronization of shared socket callback pointers, letting concurrent CPUs invoke stale callbacks, exploit requires concurrent socket operations.
- 9.1 /10 CriticalCVE-2026-90230
Linux Kernel - Out of Bounds Read
Linux kernel contains a heap out-of-bounds read in nvmet_auth_negotiate() caused by improper validation of host-supplied transfer length and identifiers, letting malicious hosts cause memory read beyond buffer, exploit requires crafted malicious host input.
- 9.8 /10 CriticalCVE-2026-90173 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in smbdirect caused by improper teardown of completion queues with ib_destroy_cq(), letting attackers cause kernel memory corruption, exploit requires triggering late completion after queue destruction.
- 9.8 /10 CriticalCVE-2026-90151 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in NFSv4 callback IDR handling caused by improper cleanup on client allocation failure, letting local attackers cause stale pointer dereference, exploit requires local access.
- 9.4 /10 CriticalCVE-2026-90110 No auth
Linux Kernel - Side Channel
Linux kernel inetpeer contains a side-channel vulnerability caused by deterministic RB-tree node comparison in inetpeer rate limiting, letting off-path attackers bypass IP-keyed ICMP rate limits by forcing eviction and reset of rate tokens, exploit requires network access to send packets.
- 9.8 /10 CriticalCVE-2026-90104 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in NFSv4.1 caused by uninitialized referring call lists in decode_cb_sequence_args, letting attackers cause denial of service via stale memory free, exploit requires NFSv4.1 usage.