Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 94 of 125

  • 9.1 /10 Critical
    CVE-2026-91995 No auth

    Pig - Authentication Bypass

    Pig < 4.1.0 contains an authentication bypass caused by discarded password verification results in /register/password endpoint, letting remote attackers overwrite any account credentials including admin, exploit requires crafted request.

  • 9.3 /10 Critical
    CVE-2026-91949 PoC publicNo auth

    FreeRDP - Authentication Bypass

    FreeRDP server < 3.31.0 contains a protocol negotiation bypass caused by improper handling of incompatible protocol requests, letting unauthenticated attackers establish RDSTLS connections despite server policy, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-91939 No auth

    Cotonti Comments - Insecure Deserialization

    Cotonti 1.0.0 Comments plugin contains a PHP object injection caused by passing the ci GET parameter to unserialize() without allowed_classes restriction, letting unauthenticated attackers instantiate arbitrary PHP objects to manipulate database or execute code, exploit requires crafted serialized payload.

  • 9.6 /10 Critical
    CVE-2026-91749 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in Workers, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-91738 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.47 contains a remote code execution caused by improper input validation in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-91729 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in DigitalCredentials, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires social engineering.

  • 9.6 /10 Critical
    CVE-2026-91728 No auth

    Google Chrome - Integer Overflow

    Google Chrome < 153.0.8010.47 contains an integer overflow caused by improper handling in V8 engine, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-91718 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free caused by memory mismanagement in Core, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-91716 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in authentication, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires user to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-91710 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in WebAppInstalls, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.1 /10 Critical
    CVE-2026-91003 Auth required

    D-Link DI-8300 - Buffer Overflow

    D-Link DI-8300 16.07 contains a buffer overflow caused by manipulation of the "redirct_url" argument in /rzgl.asp CGI Service, letting remote attackers execute code, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-91001 Auth required

    D-Link DI-8400 - Buffer Overflow

    D-Link DI-8400 16.07 contains a stack-based buffer overflow caused by manipulation of the serv/user/host/wild/mx/bmx/cust/ip arguments in /ddns.asp DDNS Configuration, letting remote attackers execute code, exploit requires crafted request.

  • 9.1 /10 Critical
    CVE-2026-90847 PoC publicAuth required

    EFM ipTIME C200E - Command Injection

    EFM ipTIME C200E 1.094 contains a command injection caused by manipulation in iux_set.cgi System Setup component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-90711 No auth

    proxy-addr - Broken Access Control

    proxy-addr 1.1.0 through 2.0.7 contains a broken access control caused by incorrect IPv4-mapped IPv6 subnet prefix handling, letting unauthenticated clients bypass IP-based restrictions by controlling X-Forwarded-For header, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-89040 No auth

    Tencent Mass Service Engine in Cluster (MSEC) - Path Traversal

    Tencent Mass Service Engine in Cluster (MSEC) contains a path traversal vulnerability caused by crafted POST requests including '../', letting remote unauthenticated attackers gain root access and execute arbitrary code, exploit requires no authentication.