Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 92 of 125

  • 9.1 /10 Critical
    CVE-2026-20194

    CVE-2026-20194

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20194 are related to incorrect resource transfer between spheres that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-669.

  • 10.0 /10 Critical
    CVE-2026-20192 No auth

    Cisco Identity Services Engine - Broken Access Control

    Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector contain improper access control vulnerabilities caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires no special conditions.

  • 9.1 /10 Critical
    CVE-2026-20176 Auth required

    Cisco ISE - Command Injection

    Cisco ISE contains a command injection caused by insufficient validation of user-supplied input in HTTP requests, letting authenticated high-privileged administrators execute arbitrary OS commands and cause DoS, exploit requires high-privileged admin credentials.

  • 10.0 /10 Critical
    CVE-2026-20130

    CVE-2026-20130

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20130 are related to improper neutralization of special elements issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.

  • 9.8 /10 Critical
    CVE-2026-14349 No auth

    TrueBooker – Appointment Booking and Scheduler System - Authorization Bypass

    TrueBooker – Appointment Booking and Scheduler System WordPress plugin <= 1.2.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers modify email addresses and reset passwords.

  • 9.8 /10 Critical
    CVE-2026-12793 PoC publicNo auth

    JetFormBuilder WordPress - Privilege Escalation

    JetFormBuilder WordPress plugin <= 3.6.2 contains a privilege escalation caused by lack of validation of form ID ownership before parsing form schema and executing server-side callbacks, letting unauthenticated attackers create admin accounts.

  • 9.8 /10 Critical
    CVE-2025-59953 No auth

    LMDeploy - Remote Code Execution

    LMDeploy 0.9.1 to < 0.10.2 contains a remote code execution caused by unsanitized use of pickle.loads() in AsyncRPCServer's call_and_response(), letting remote attackers execute arbitrary code via crafted RPC messages, exploit requires network access to RPC server.

  • 9.8 /10 Critical
    CVE-2025-56563 No auth

    Zenith Satellite Tracker - Server Side Request Forgery

    Zenith Satellite Tracker 1.0 contains a server side request forgery caused by lack of host or scheme validation in sat_proxy.php's URL parameter, letting unauthenticated remote attackers make arbitrary HTTP/HTTPS requests.

  • 9.1 /10 Critical
    CVE-2026-92240 No auth

    Thunderbird - Denial of Service

    Thunderbird contains an out-of-bounds read caused by processing untagged '* ID' responses in the IMAP response parser, letting remote attackers crash the application before authentication.

  • 9.8 /10 Critical
    CVE-2026-92238 No auth

    Thunderbird - Memory Safety Violation

    Thunderbird contains a mail header parsing vulnerability caused by maliciously constructed headers, letting attackers cause memory safety violations or merge multiple fields, exploit requires crafted mail headers.

  • 9.1 /10 Critical
    CVE-2026-92079

    Mozilla Firefox - Mitigation Bypass

    Mozilla Firefox contains a mitigation bypass vulnerability in the Widget: Win32 component, letting attackers bypass security mitigations, exploit requires unspecified conditions.

  • 9.1 /10 Critical
    CVE-2026-92075

    Firefox - Mitigation Bypass

    Firefox contains a mitigation bypass vulnerability in the Networking component, letting attackers bypass security mitigations, exploit requires unspecified conditions.

  • 9.6 /10 Critical
    CVE-2026-92071 No auth

    Mozilla Firefox - Sandbox Escape

    Mozilla Firefox < 156 and Firefox ESR < 153.3 contain a sandbox escape caused by incorrect boundary conditions in the Widget: Win32 component, letting attackers escape sandbox restrictions, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-92066

    Firefox - Sandbox Escape

    Firefox contains a sandbox escape caused by a vulnerability in the Profile Backup component, letting attackers escape sandbox restrictions, exploit requires unspecified conditions.

  • 9.8 /10 Critical
    CVE-2026-92061

    Firefox - Sandbox Bypass

    Firefox contains a security vulnerability caused by incorrect boundary conditions in the Process Sandboxing component, letting attackers potentially bypass sandbox restrictions, exploit requires unspecified conditions.