Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 88 of 125
- 9.8 /10 CriticalCVE-2026-90036 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in NFSD caused by improper client reference handling during blocked-lock reaping, letting attackers cause memory corruption, exploit requires triggering blocked-lock reaping.
- 9.8 /10 CriticalCVE-2026-90012 No auth
Linux Kernel spi - Denial of Service & Privilege Escalation
Linux kernel spi subsystem contains a buffer management vulnerability caused by improper DMA mapping ownership handling in __spi_map_msg(), letting attackers trigger kernel oops or memory corruption, exploit requires kernel-level access.
- 9.1 /10 CriticalCVE-2026-90011 No auth
Linux Kernel scsi target iscsi - Out of Bounds Read
Linux kernel scsi target iscsi contains a buffer overflow caused by insufficient allocation for a NUL terminator in login payload buffer, letting unauthenticated initiators potentially read adjacent memory, exploit requires iscsi portal configured for CHAP authentication.
- 9.8 /10 CriticalCVE-2026-89990
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in ceph_mds_check_access() caused by traversing a freed array without holding the mutex, letting local attackers cause kernel crashes or memory corruption, exploit requires concurrent session reopen.
- 9.8 /10 CriticalCVE-2026-89972
Linux Kernel - Use After Free
Linux kernel contains a use-after-free caused by missing SRCU grace period in nvme_alloc_ns() error path, letting concurrent SRCU readers access freed namespace structures, exploit requires concurrent access to NVMe multipath namespace.
- 9.8 /10 CriticalCVE-2026-89970
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in nvmet-auth caused by asynchronous cancellation of delayed work during submission queue teardown, letting attackers cause memory corruption or system instability, exploit requires access to NVMe target queues.
- 9.8 /10 CriticalCVE-2026-89969 No auth
Linux Kernel nvmet-tcp - Out-of-Bounds Write
Linux kernel nvmet-tcp contains an out-of-bounds write vulnerability caused by improper bounds checking when receiving an over-long PDU, letting remote unauthenticated attackers corrupt adjacent kernel memory, exploit requires sending crafted PDU.
- 9.3 /10 CriticalCVE-2026-89930 No auth
Linux Kernel KVM - Broken Access Control
Linux kernel KVM nVMX contains a broken access control vulnerability caused by missing local TLB flushes on failed nested VM-Enter, letting attackers cause stale TLB entries leading to potential privilege escalation, exploit requires nested virtualization environment.
- 9.3 /10 CriticalCVE-2026-89918
Linux Kernel KVM arm64 - Logic Error
Linux kernel KVM arm64 contains a logic error in TLB invalidation by VA caused by incorrect address range comparison that fails on address rollover, letting attackers cause failed TLB invalidation, exploit requires kernel-level access.
- 9.3 /10 CriticalCVE-2026-89916
Linux Kernel KVM arm64 - Race Condition
Linux kernel KVM arm64 contains a race condition in VNCR TLB invalidation caused by improper handling of concurrent page faults and TLB updates, letting attackers cause inconsistent memory translation, exploit requires concurrent vCPU execution.
- 9.3 /10 CriticalCVE-2026-89915
Linux Kernel KVM arm64 - Authentication Bypass
Linux kernel KVM arm64 contains a broken authentication caused by flawed VM-wide VNCR mapping counter logic, letting attackers potentially bypass TLB invalidation guarantees, exploit requires specific CPU and VM conditions.
- 9.3 /10 CriticalCVE-2026-89914 No auth
Linux Kernel KVM arm64 - Memory Management Vulnerability
Linux kernel contains a sign extension omission vulnerability in KVM arm64 decode_range_tlbi helper for range-based TLBI invalidation, letting attackers cause potential memory management issues, exploit requires specific usage of S2 invalidation.
- 9.8 /10 CriticalCVE-2026-89857
Linux Kernel qla2xxx - Race Condition
Linux kernel qla2xxx driver contains a race condition caused by missing qpair lock when sending NVMe LS reject, letting concurrent processes corrupt request ring state, leading to duplicated or dropped commands, exploit requires concurrent access to base_qpair.
- 9.8 /10 CriticalCVE-2026-89847 No auth
Linux Kernel qla2xxx - Use After Free
Linux kernel contains a use-after-free vulnerability in the qla2xxx SCSI driver caused by double completion in async IOCB timeout handling, letting attackers cause memory corruption, exploit requires triggering async IOCB timeout.
- 9.1 /10 CriticalCVE-2026-89846 No auth
Linux Kernel qla2xxx - Information Disclosure
Linux kernel scsi qla2xxx contains an information disclosure vulnerability caused by an out-of-bounds read in sense-data handling due to improper rsp_info_len validation, letting attackers leak adjacent memory, exploit requires a hostile or buggy target.