Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 9 of 125

  • 9.8 /10 Critical
    CVE-2026-101950 No auth

    Juniper Networks Junos OS - Buffer Overflow

    Juniper Networks Junos OS on SRX Series contains a heap-based buffer overflow caused by malformed IPv4 packets in the SVR component, letting unauthenticated network attackers cause denial of service and compromise confidentiality and integrity, exploit requires network access to an interface configured for Secure Vector Routing.

  • 9.8 /10 Critical
    CVE-2020-37282 No auth

    office-converter - Command Injection

    office-converter through 1.0.2 contains a command injection caused by unsanitized fileName input in generatePdf() or generateHtml(), letting attackers execute OS commands with Node.js process privileges, exploit requires crafted fileName input.

  • 9.8 /10 Critical
    CVE-2026-97816 No auth

    OpenSSH for Windows - Remote Code Execution

    OpenSSH for Windows contains a use after free vulnerability that allows unauthorized attackers to execute code over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-97815 No auth

    Windows Error Reporting - Remote Code Execution

    Windows Error Reporting contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-97814 No auth

    Windows Text Shaping - Remote Code Execution

    Windows Text Shaping contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-97805 No auth

    Windows Partition Management Driver - Remote Code Execution

    Windows Partition Management Driver contains an out-of-bounds read vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-97749 No auth

    Microsoft Office Outlook - Remote Code Execution

    Microsoft Office Outlook contains a double free vulnerability caused by improper memory management, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-97381 Auth required

    Legacy Update - Broken Access Control

    Legacy Update 1.12.0 through 1.13.1 contains a broken access control caused by an origin validation error in the IsPermitted method of its ActiveX control, letting attackers via malicious IE webpages install updates, enumerate system info, or reboot without user consent, exploit requires user to visit a malicious webpage in Internet Explorer.

  • 10.0 /10 Critical
    CVE-2026-97229 PoC publicNo auth

    GitLab CE/EE - Remote Code Execution

    GitLab CE/EE >= 19.2 < 19.2.8, >= 19.3 < 19.3.5, and >= 19.4 < 19.4.2 contain a remote code execution caused by insufficient regular expression validation in CI/CD configuration, letting unauthenticated users execute arbitrary code remotely, exploit requires crafted regex in CI/CD config.

  • 9.8 /10 Critical
    CVE-2026-97016 No auth

    Microsoft Office Outlook - Remote Code Execution

    Microsoft Office Outlook contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-96934 No auth

    Windows DHCP Server - Remote Code Execution

    Windows DHCP Server contains a use after free vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-96924 No auth

    Windows OLE - Remote Code Execution

    Windows OLE contains an untrusted pointer dereference vulnerability caused by improper pointer handling, letting unauthorized attackers execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-96909 No auth

    Windows BitLocker - Remote Code Execution

    Windows BitLocker contains a heap-based buffer overflow, letting unauthorized attackers execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-96864 No auth

    Microsoft Failover Cluster Virtual Driver - Remote Code Execution

    Microsoft Failover Cluster Virtual Driver contains a double free vulnerability, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-96320 No auth

    Windows DHCP Server - Remote Code Execution

    Windows DHCP Server contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.