High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 10 of 552

  • 8.7 /10 High
    CVE-2026-76660 Auth required

    HPE NonStop CIPSAM - Buffer Overflow

    HPE NonStop CIPSAM contains a buffer overflow caused by an out-of-bounds write, letting attackers corrupt buffer data, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-76659 No auth

    HPE NonStop TCP/IP UTILITIES - Denial of Service

    HPE NonStop TCP/IP UTILITIES contains a denial of service vulnerability in the finger daemon, letting unauthenticated remote attackers cause service disruption, exploit requires network access.

  • 8.2 /10 High
    CVE-2026-76184 No auth

    Eclipse Jetty HttpClient - Open Redirect

    Eclipse Jetty HttpClient contains an open redirect caused by improper path normalization in redirects, letting attackers on the same domain receive Authorization headers intended for other paths, exploit requires attacker-controlled redirects on the same domain.

  • 7.5 /10 High
    CVE-2026-76066 No auth

    IntentKit - Authorization Bypass

    IntentKit <= 2.6.3 contains an authorization bypass caused by executor validating tool calls against the full tool registry instead of per-request narrowed tool advertisement, letting unauthenticated attackers execute owner-only state-changing tools without approval, exploit requires supplying exact de-advertised tool name and arguments.

  • 7.1 /10 High
    CVE-2026-74920 No auth

    Document Gallery WordPress - Reflected XSS

    Document Gallery WordPress plugin <= 5.1.1 contains a reflected XSS caused by improper sanitization and escaping of user input in an unauthenticated AJAX action, letting attackers execute scripts in visitors' browsers, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-73799 No auth

    HPE NonStop SNMP Trap Multiplexer - Memory Corruption

    HPE NonStop SNMP Trap Multiplexer contains a memory corruption vulnerability, letting attackers potentially cause system instability or execute arbitrary code, exploit requires unspecified conditions.

  • 8.2 /10 High
    CVE-2026-63315 No auth

    Slican IPx - Information Disclosure

    Slican IPx telephone exchanges before 6.62.0100 contain an information disclosure vulnerability caused by storing temporary subscriber passwords in plaintext, letting attackers with database access obtain user passwords and log in, exploit requires database access.

  • 8.7 /10 High
    CVE-2026-63314 Auth required

    Slican IPx - SQL Injection

    Slican IPx telephone exchanges < 6.62.0100 contain a SQL injection caused by improper neutralization of input in /webcti/admin_json.php endpoint, letting authenticated attackers execute SQL injection attacks.

  • 8.7 /10 High
    CVE-2026-53882 Auth required

    Virtualization Station - Broken Access Control

    Virtualization Station < 4.1.1.130 contains a broken access control vulnerability caused by improper link resolution before file access, letting remote attackers with user accounts compromise system security, exploit requires user authentication.

  • 7.6 /10 High
    CVE-2026-53574 Auth required

    EspoCRM - SQL Injection

    EspoCRM 8.1.0 to < 9.3.8 contains a SQL injection caused by crafted 'where' parameter in GET entity streamAttachments endpoint, letting authenticated non-administrators extract database info and escalate privileges.

  • 8.7 /10 High
    CVE-2026-44084 No auth

    Video Station - Authorization Bypass

    Video Station < 5.8.8 contains an authorization bypass caused by user-controlled key, letting remote attackers obtain sensitive data, exploit requires no special privileges.

  • 8.6 /10 High
    CVE-2026-41545 Auth required

    QuMagie - Path Traversal

    QuMagie < 2.9.1 contains a path traversal caused by improper validation of file paths, letting remote attackers with administrator privileges read arbitrary files, exploit requires administrator account.

  • 8.7 /10 High
    CVE-2026-41544 Auth required

    QcalAgent - Path Traversal

    QcalAgent < 1.1.10 contains a path traversal caused by insufficient validation of file paths, letting remote attackers with user accounts read arbitrary files, exploit requires user authentication.

  • 8.9 /10 High
    CVE-2026-39997 No auth

    HybridDesk Station - Authentication Bypass

    HybridDesk Station < 4.2.22 contains a broken authentication caused by missing authentication for critical functions, letting remote attackers gain unauthorized access, exploit requires no special privileges.

  • 8.7 /10 High
    CVE-2026-39993 Auth required

    Download Station - Path Traversal

    Download Station contains a path traversal caused by improper validation of file paths, letting remote attackers with user accounts read unexpected files or system data, exploit requires user authentication.