High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 105 of 552

  • 8.8 /10 High
    CVE-2026-110140 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.79 contains a remote code execution caused by type confusion in V8 engine, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-110139 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free vulnerability in Media, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.3 /10 High
    CVE-2026-110138 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free vulnerability in ShapeDetection, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML page.

  • 8.8 /10 High
    CVE-2026-110137 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.79 contains a use after free vulnerability in WebRTC, caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 7.5 /10 High
    CVE-2026-110128 No auth

    fuint - Authentication Bypass

    fuint contains a missing authentication vulnerability caused by lack of access control in /clientApi/order/detail endpoint, letting unauthenticated attackers retrieve any member's order details including sensitive personal information, exploit requires no authentication.

  • 8.1 /10 High
    CVE-2026-110124 Auth required

    FastBee - Broken Access Control

    FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController, letting authenticated low-privilege users read and modify other tenants' devices by supplying sequential device IDs, exploit requires user authentication.

  • 7.1 /10 High
    CVE-2026-110123 Auth required

    Makunet maku-boot - Broken Access Control

    Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability caused by lack of authority checks in /sys/mail/config/list and /sys/sms/config/list, letting authenticated users read sensitive mail and SMS configurations and send mail to arbitrary recipients, exploit requires user authentication.

  • 7.1 /10 High
    CVE-2026-110119 Auth required

    Yshopmall - Broken Access Control

    Yshopmall 2.0.0 contains an insecure direct object reference vulnerability in the member address API, letting authenticated members read, overwrite, and delete other members' shipping addresses, exploit requires authentication.

  • 7.5 /10 High
    CVE-2026-110115 No auth

    Risesoft Digital-Infrastructure - Path Traversal

    Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability caused by improper validation in fileManager Y9FileController.retrieveFileStream handler, letting unauthenticated attackers read arbitrary files via crafted fullPath and fileName parameters.

  • 8.1 /10 High
    CVE-2026-110112 No auth

    Dockhand - Broken Access Control

    Dockhand < 1.0.50 contains a broken access control vulnerability caused by lack of validation of OIDC iss, aud, nonce, and exp claims, letting attackers with admin rights in another tenant escalate privileges to admin, exploit requires attacker to have admin rights in another tenant.

  • 7.5 /10 High
    CVE-2026-110111 Auth required

    Xen Orchestra - Broken Access Control

    Xen Orchestra < 6.9.0 contains an improper access control vulnerability caused by unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods, letting authenticated users escalate to global administrator and execute remote code by exploiting prototype pollution via crafted .vmx files.

  • 8.1 /10 High
    CVE-2026-110108 Auth required

    MateCloud - Broken Access Control

    MateCloud through 5.0.8 contains a broken access control vulnerability caused by missing authorization in /api/v1/admin/storage endpoints in StorageController, letting authenticated low-privilege users manage object storage, exploit requires user authentication.

  • 7.5 /10 High
    CVE-2026-110102

    Powerlevel10k - Remote Code Execution

    Powerlevel10k <= 1.20.0 contains an insecure download vulnerability caused by disabled TLS certificate verification and skipped integrity checks in gitstatus/install script, letting network attackers execute malicious code as user, exploit requires network interception.

  • 8.1 /10 High
    CVE-2026-110097 Auth required

    Ikaros - Authentication Bypass

    Ikaros 1.2.0 through 1.2.5 contains an authentication bypass caused by reuse of login temp token in jwt/apply endpoint, letting attackers with valid password skip TOTP verification and gain full account access.

  • 7.1 /10 High
    CVE-2026-110084 Auth required

    Adobe Experience Manager - Security Feature Bypass

    Adobe Experience Manager contains an xml external entity injection caused by blind XPath injection, letting low-privileged attackers bypass security features and gain unauthorized read and limited write access, exploit requires no user interaction.