Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 98 of 166

  • 9.6 /10 Critical
    CVE-2026-95299 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free vulnerability in GPU, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-95284 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.57 contains a buffer overflow in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-95283 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.57 contains a buffer overflow caused by improper handling in Tint component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-95281 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.57 contains a buffer overflow in ANGLE caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-95277 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free caused by improper memory handling in Views, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.8 /10 Critical
    CVE-2026-94952 No auth

    TOTOLINK N150RT - Buffer Overflow

    TOTOLINK N150RT firmware V3.4.0-B20201030 contains a buffer overflow caused by improper handling of ip_subnet and fw_ip parameters in /boafrm/formPortFw, letting remote attackers cause memory corruption, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-91048 No auth

    Apache Karaf - Privilege Escalation & Remote Code Execution

    Apache Karaf contains a privilege escalation to remote code execution caused by lack of ACL rules for jdbc:* and jms:* shell commands, letting authenticated users with viewer role execute arbitrary code via crafted JDBC URLs, exploit requires authenticated shell session with viewer role.

  • 9.8 /10 Critical
    CVE-2026-91012 No auth

    Apache Karaf - Path Traversal & Privilege Escalation

    Apache Karaf config.core.impl.ConfigRepositoryImpl contains a path traversal vulnerability caused by insufficient validation of file paths derived from user-supplied input in configuration update methods, letting manager-role users write arbitrary files within the Karaf process writable directories, exploit requires manager role privileges.

  • 9.1 /10 Critical
    CVE-2026-84436 Auth required

    IBM Guardium Data Protection - Command Injection

    IBM Guardium Data Protection 12.2 contains a command injection caused by improper input handling in the certificate export CLI functionality, letting privileged authenticated CLI users execute arbitrary commands with root privileges.

  • 9.9 /10 Critical
    CVE-2026-84154 Auth required

    GEOVIA Geospatial Data Manager - Command Injection

    GEOVIA Geospatial Data Manager Release 3DEXPERIENCE R2024x through R2026x contains a code injection vulnerability caused by improper input handling, letting attackers execute arbitrary code on the server, exploit requires no special conditions.

  • 9.4 /10 Critical
    CVE-2026-82973 No auth

    psyb0t/docker-mailbox - CRLF Injection

    psyb0t/docker-mailbox < 0.4.13 contains a CRLF injection caused by improper neutralization of CRLF sequences in IMAP command construction, letting remote unauthenticated attackers inject additional IMAP commands via crafted folder, UID, or search values when bearer-token authentication is not configured.

  • 9.1 /10 Critical
    CVE-2026-8066 No auth

    Hitachi Energy RTU500 - Directory Traversal

    Hitachi Energy RTU500 contains a directory traversal vulnerability in the file upload functionality, letting unauthenticated attackers write or overwrite arbitrary files on the device file system, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-8065 PoC publicNo auth

    Hitachi Energy RTU500 - Authentication Bypass

    Hitachi Energy RTU500 contains an authentication bypass caused by improper validation in the firmware update endpoint, letting unauthenticated attackers upload arbitrary firmware, exploit requires crafted POST request.

  • 9.8 /10 Critical
    CVE-2026-79538 No auth

    metatool-ai MetaMCP - Remote Code Execution

    metatool-ai MetaMCP <= 2.4.22 contains a remote code execution caused by unsafe handling in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio, letting remote attackers execute arbitrary code, exploit requires network access to the endpoint.

  • 9.1 /10 Critical
    CVE-2026-79537 No auth

    metatool-ai MetaMCP - Broken Access Control

    metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference caused by improper session ID validation in MCP transport session dispatch, letting attackers access and execute other tenants' private MCP tools, exploit requires attacker to obtain another tenant's session ID.