Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 90 of 166

  • 9.6 /10 Critical
    CVE-2026-103628 No auth

    Google Chrome - Out of Bounds Write

    Google Chrome < 154.0.8037.97 contains an out of bounds write in WebGL caused by improper bounds checking, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-103626 No auth

    Google Chrome - Broken Access Control

    Google Chrome on Windows < 154.0.8037.97 contains a broken access control caused by incorrect authorization in FileSystem, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires social engineering.

  • 9.3 /10 Critical
    CVE-2026-102795 No auth

    Apache Traffic Server - Broken Access Control

    Apache Traffic Server 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 contains an improper access control vulnerability caused by flawed authorization checks, letting attackers bypass access restrictions, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2023-54405 CISA KEVNo auth

    H3C CVM - Unrestricted File Upload

    H3C CVM contains an unauthenticated arbitrary file upload vulnerability caused by insufficient validation of the token parameter in /cas/fileUpload/upload, letting remote attackers upload malicious files and achieve remote code execution, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-96659 Auth required

    Foreman - Broken Access Control

    Foreman contains an information disclosure and command execution vulnerability caused by insufficient access control in template preview endpoints, letting authenticated low-level Viewer users access sensitive data and execute commands under insecure configurations.

  • 9.9 /10 Critical
    CVE-2026-96658 Auth required

    Foreman - Remote Code Execution

    Foreman contains a remote code execution caused by improper handling of delegated methods in the templating engine, letting authenticated low-permission attackers bypass safemode sandbox and execute arbitrary commands.

  • 9.1 /10 Critical
    CVE-2026-92966 PoC publicNo auth

    Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress - Stored XSS

    Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.7.0 contains a stored XSS caused by improper validation before running do_shortcode, letting unauthenticated attackers execute arbitrary shortcodes via booking flow.

  • 9.8 /10 Critical
    CVE-2026-82829 No auth

    Hitachi Coding Software Suite - Authentication Bypass

    Hitachi Coding Software Suite through 3.3.0 contains a broken authentication caused by hidden functionality such as hidden accounts or hardcoded credentials, letting attackers gain unauthorized access, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-82827 No auth

    Hitachi Coding Software Suite - Authentication Bypass

    Hitachi Coding Software Suite <= 3.3.0 contains a hardcoded cryptographic key vulnerability caused by hardcoding the JWT signing secret key, letting attackers generate unauthorized Bearer tokens to exploit administrative functions, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-82825 No auth

    Hitachi Coding Software Suite - Authentication Bypass

    Hitachi Coding Software Suite through 3.3.0 contains a broken authentication caused by missing authentication for a critical API, letting unauthenticated attackers retrieve or alter sensitive information or manipulate data.

  • 9.8 /10 Critical
    CVE-2026-82824 No auth

    Hitachi Coding Software Suite - Path Traversal

    Hitachi Coding Software Suite through 3.3.0 contains a path traversal vulnerability caused by improper validation of file paths, letting attackers access, create, modify, or delete files, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-79901

    boks_keytabmd - Authentication Bypass

    boks_keytabmd contains a predictable password generation vulnerability caused by seeding with the current Unix timestamp, letting attackers reproduce and verify Active Directory service-account passwords offline, exploit requires knowledge of service principal and password-change time estimation.

  • 9.1 /10 Critical
    CVE-2026-79898 Auth required

    Fortra BoKS Manager - Command Injection

    Fortra BoKS Manager contains a command injection caused by shell command substitution in crlserver, letting authenticated users with CRL URL addition privileges execute commands as root, exploit requires user authentication with specific privileges.

  • 9.8 /10 Critical
    CVE-2026-75957 No auth

    Ultimate Multisite WordPress - Authentication Bypass

    Ultimate Multisite WordPress plugin <= 2.15.0 contains an authentication bypass caused by improper validation in the checkout_form parameter in login_customer_after_checkout, letting unauthenticated attackers log in as any user by knowing their email, exploit requires targeted user to have no pre-existing Ultimate Multisite customer record.

  • 9.3 /10 Critical
    CVE-2026-62071 No auth

    WordPress File Upload - SQL Injection

    WordPress File Upload <= 5.1.10 contains an SQL injection caused by unsanitized input in SQL queries, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no authentication.