Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 90 of 125
- 9.0 /10 CriticalCVE-2026-76420
Cisco Secure FMC Software - Command Injection
Cisco Secure FMC Software contains a command injection caused by incorrect initialization of encryption parameters in the Apache JServ Protocol (AJP) connector, letting unauthenticated remote attackers execute commands as root, exploit requires sftunnel connection to Cisco Secure FTD Software to be down.
- 9.8 /10 CriticalCVE-2026-76187 No auth
Apache Airflow - Authentication Bypass
Apache Airflow Keycloak provider contains an authentication bypass caused by unauthenticated token endpoint accepting any confidential client credentials in a shared Keycloak realm, letting attackers authenticate as any client, exploit requires valid credentials of any confidential client in the realm.
- 9.1 /10 CriticalCVE-2026-76186 No auth
Apache Airflow - Broken Access Control
Apache Airflow 3.3+ with Keycloak auth manager contains a broken access control caused by separate unauthenticated cookies for Keycloak tokens not bound to session identity, letting logged-in users escalate privileges by pairing foreign tokens, exploit requires valid Airflow login and foreign Keycloak tokens.
- 9.1 /10 CriticalCVE-2026-75513 Auth required
Marten - SQL Injection
Marten 7.0.0 to 9.13.0 contains a SQL injection caused by unescaped interpolation of attacker-controlled strings into single-quoted SQL literals in LINQ and tenant-management paths, letting attackers bypass filters and exfiltrate or modify data, exploit requires crafted input with single quotes.
- 10.0 /10 CriticalCVE-2026-73456
Arista EOS - Remote Code Execution
Arista EOS contains a remote code execution caused by crafted malicious requests in gRPC Network Packet Sampling Interface (gNPSI), letting unauthenticated attackers gain full administrative control, exploit requires gNPSI enabled.
- 10.0 /10 CriticalCVE-2026-73453 No auth
Arista EOS - Remote Code Execution
Arista EOS contains a remote code execution caused by crafted malicious packets during P4Runtime session initiation, letting unauthenticated attackers gain complete administrative control, exploit requires P4Runtime enabled and network access.
- 9.1 /10 CriticalCVE-2026-73447 Auth required
Arista EOS - Command Injection & Privilege Escalation
Arista EOS-based products contain a command injection caused by crafted requests to gRPC Network Security Interface (gNSI) Certz and Bootz services, letting authenticated attackers escalate privileges and execute arbitrary OS commands.
- 10.0 /10 CriticalCVE-2026-70416 No auth
Dell ObjectScale - Remote Code Execution
Dell ObjectScale < 4.4.0.0 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting unauthenticated remote attackers execute arbitrary code remotely, exploit requires remote access.
- 9.8 /10 CriticalCVE-2026-68536 No auth
Apache MyFaces Core - Server-Side Request Forgery & Local File Inclusion
Apache MyFaces Core contains a server-side request forgery and local file inclusion caused by improper input validation, letting attackers make arbitrary server requests or include local files, exploit requires crafted requests.
- 9.1 /10 CriticalCVE-2026-61594 No auth
djust - Authentication Bypass
djust < 1.0.7 contains an authentication bypass caused by WebSocket transport not enforcing Django's standard authorization checks, letting anonymous or under-privileged clients access and dispatch admin views, exploit requires WebSocket access.
- 9.8 /10 CriticalCVE-2026-51990 CISA KEVPoC publicNo auth
Sogou Sogou Input Method - Remote Code Execution
Sogou Sogou Input Method < 16.3.0.3498 contains a remote code execution caused by vulnerability in biz_helper.exe component, letting remote attackers execute arbitrary code, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-27565 No auth
Unspecified Product - Unrestricted File Upload
An unspecified product contains an unrestricted file upload vulnerability caused by allowing unauthenticated remote attackers to upload malicious IODD files, letting attackers execute persistent shell scripts with root privileges, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-27546 No auth
Unknown - Authentication Bypass
Unknown product contains an authentication bypass caused by flaw in _account_log function, letting unauthenticated remote attackers log in as admin, exploit requires no special conditions.
- 9.1 /10 CriticalCVE-2026-20341 Auth required
Cisco Secure FMC Software - Authentication Bypass
Cisco Secure FMC Software contains an insecure deserialization vulnerability in the sftunnel inter-device communication protocol, letting authenticated remote attackers gain root privileges by sending crafted RPCs, exploit requires valid administrative credentials.
- 9.9 /10 CriticalCVE-2026-20332
Cisco Secure Firewall - Broken Access Control
Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software contain improper access control vulnerabilities caused by insufficient authorization checks, letting attackers bypass restrictions, exploit requires unspecified conditions.