Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 97 of 166

  • 9.8 /10 Critical
    CVE-2026-100512 No auth

    Nested Pages - PHP Object Injection

    Nested Pages <= 3.3.2 contains a PHP Object Injection caused by unsafe handling of serialized objects, letting attackers execute arbitrary code remotely, exploit requires crafted serialized input.

  • 10.0 /10 Critical
    CVE-2026-96587

    Viidure Android - Hardcoded Credentials

    Viidure Android application contains hardcoded plaintext cloud storage credentials in its compiled code, letting attackers access and modify critical platform storage including firmware and application binaries, exploit requires access to the app binary.

  • 9.6 /10 Critical
    CVE-2026-95357 PoC publicNo auth

    Google Chrome - Remote Code Execution

    Google Chrome on Android < 154.0.8037.57 contains an out of bounds write in GPU caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-95356 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free caused by improper memory handling in WindowDialog, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-95350 PoC publicNo auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.57 contains a buffer overflow in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-95349 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.57 contains a buffer overflow in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-95347 No auth

    Google Chrome - Use After Free

    Google Chrome on Mac < 154.0.8037.57 contains a use after free vulnerability in Updater caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted network traffic.

  • 9.6 /10 Critical
    CVE-2026-95339 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free vulnerability in ServiceWorker, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-95331 No auth

    Google Chrome - Out of Bounds Write

    Google Chrome < 154.0.8037.57 contains an out of bounds write caused by improper memory handling in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-95329 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Android < 154.0.8037.57 contains an out of bounds write in WebGL caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-95325 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free vulnerability in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-95318 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 154.0.8037.57 contains a buffer overflow in Video component caused by improper handling of crafted HTML pages, letting remote attackers execute arbitrary code outside the sandbox, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-95313 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free vulnerability in Fullscreen, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-95311 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 154.0.8037.57 contains a remote code execution caused by improper free of non-heap memory in Fonts, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-95310 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free caused by improper memory handling in AdFilter, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.