High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 103 of 552

  • 7.1 /10 High
    CVE-2026-110216 Auth required

    youlai-boot - Broken Access Control

    youlai-boot <= 2.21.1 contains a broken access control caused by missing @PreAuthorize check in updateUserStatus handler, letting authenticated users enable or disable accounts, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-110215 Auth required

    Youlai-boot - Broken Access Control

    Youlai-boot <= 2.21.1 contains a broken access control vulnerability caused by missing authorization checks in PUT /api/v1/roles/{roleId}/menus, letting authenticated low-privileged users escalate their permissions to administrator-equivalent access by assigning arbitrary menu and button permissions, exploit requires authenticated low-privileged user.

  • 8.1 /10 High
    CVE-2026-110211 Auth required

    iFlytek SkillHub - Broken Access Control

    iFlytek SkillHub <= 0.2.22 contains a broken access control caused by missing authorization checks in DELETE /api/cli/v1/skills/{namespace}/{slug}, letting authenticated users delete other users' skills permanently, exploit requires authentication.

  • 7.1 /10 High
    CVE-2026-110208 Auth required

    Wukong AICRM - Broken Access Control

    Wukong AICRM through 20260610 contains a broken access control vulnerability caused by missing authorization in /systemConfig controller, letting authenticated users read stored AI provider API keys, exploit requires user authentication.

  • 8.8 /10 High
    CVE-2026-110207 Auth required

    Wukong AICRM - Broken Access Control

    Wukong AICRM through 20260610 contains a broken access control vulnerability caused by missing administrator checks in user, role, department, and agent administration APIs, letting authenticated users achieve full administrator account takeover via /managerUser/updateUser POST requests.

  • 8.8 /10 High
    CVE-2026-110206

    Roo Code - Command Injection

    Roo Code through 3.54.0 contains a command approval bypass caused by command substitution in parseCommandLine(), letting attackers auto-approve arbitrary shell commands, exploit requires indirect prompt injection.

  • 8.8 /10 High
    CVE-2026-110205

    Roo Code - Command Approval Bypass

    Roo Code through 3.54.0 contains a command approval bypass caused by parseCommandLine() discarding command substitutions next to glob characters, letting attackers using indirect prompt injection execute denied commands without user approval, exploit requires auto-approval enabled.

  • 8.8 /10 High
    CVE-2026-110204

    Roo Code - Command Injection

    Roo Code through 3.54.0 contains a command approval bypass caused by parseCommandLine() treating ${ command; } substitutions as parameter expansions, letting attackers run denied shell commands via indirect prompt injection, exploit requires use of bash 5.3+ or ksh93.

  • 8.8 /10 High
    CVE-2026-110203 No auth

    Roo Code - Command Approval Bypass

    Roo Code through 3.54.0 contains a command approval bypass caused by quote-masking regex in parseCommandLine(), letting attackers auto-approve denied shell commands via indirect prompt injection, exploit requires crafted command input.

  • 8.8 /10 High
    CVE-2026-110202

    Roo Code - Command Injection

    Roo Code through 3.54.0 contains a command approval bypass caused by improper handling of shell command prefixes in getCommandDecision(), letting attackers auto-approve denied shell commands, exploit requires indirect prompt injection.

  • 8.8 /10 High
    CVE-2026-110172 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free vulnerability in Media, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110171 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free vulnerability in Media, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110169 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110168 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110167 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free caused by improper memory handling in Media component, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page.