High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 106 of 552

  • 7.1 /10 High
    CVE-2026-110083 Auth required

    Adobe Experience Manager - SQL Injection

    Adobe Experience Manager contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers bypass security features and gain unauthorized read and limited write access, exploit requires no user interaction.

  • 7.3 /10 High
    CVE-2026-110025 PoC publicNo auth

    Slackero phpwcms - Unrestricted File Upload

    Slackero phpwcms <= 1.9.49/1.12.3 contains an unrestricted file upload vulnerability caused by manipulation of the POST_name argument in include/inc_front/content/cnt23.article.inc.php, letting remote attackers upload arbitrary files, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-109967 No auth

    yt-dlp-web-ui - Denial of Service

    yt-dlp-web-ui through 4.0.0 contains a null pointer dereference vulnerability in the Service.Formats JSON-RPC method, letting remote unauthenticated attackers crash the server by sending crafted requests with invalid url values.

  • 7.1 /10 High
    CVE-2026-109965 No auth

    Serena - Path Traversal

    Serena before 2.0.0 contains a path traversal vulnerability caused by improper symlink resolution in Project.is_path_in_project(), letting attackers read or overwrite files outside the project root, exploit requires committing symlinks inside a repository.

  • 8.5 /10 High
    CVE-2026-109961 Auth required

    Froxlor - Authentication Bypass

    Froxlor < 2.3.14 contains a newline injection vulnerability caused by unvalidated additional_members parameter in Ftps.add API, letting authenticated customers inject arbitrary entries into root-owned NSS group database, exploit requires authentication.

  • 7.7 /10 High
    CVE-2026-109960 Auth required

    Froxlor - Stored XSS & Broken Authentication & Broken Access Control

    Froxlor < 2.3.14 contains a stored cross-site scripting vulnerability caused by improper sanitization of the theme value in customer_index.php, letting authenticated customers inject scripts that execute when administrators view the customer overview, exploit requires authenticated customer access.

  • 7.0 /10 High
    CVE-2026-109956 No auth

    NLTK - Path Traversal

    NLTK through 3.10.3 contains a path traversal vulnerability caused by unvalidated model paths in WekaClassifier, letting attackers write or probe files outside allowed data roots, exploit requires control over model_filename or model argument.

  • 7.5 /10 High
    CVE-2026-109832 No auth

    Gnome-remote-desktop - Denial of Service

    Gnome-remote-desktop in Red Hat Enterprise Linux contains a denial of service caused by unbounded busy loop handling retryable GnuTLS results in VNC TLS I/O handlers, letting remote attackers cause high CPU usage, exploit requires network access to VNC TLS listener.

  • 8.8 /10 High
    CVE-2026-109778

    Mozilla Firefox - Privilege Escalation

    Mozilla Firefox < 158 and Firefox ESR < 153.5 contain a privilege escalation caused by a vulnerability in the WebExtensions component, letting attackers escalate privileges, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-109756 No auth

    Firefox - Privilege Escalation

    Firefox < 158 and Firefox ESR < 153.5 contain a privilege escalation caused by a flaw in the DOM Navigation component, letting attackers escalate privileges, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-109743 Auth required

    Firefox - Privilege Escalation

    Firefox before 158 and Firefox ESR before 153.5 contain a privilege escalation caused by a flaw in the Panning and Zooming component, letting attackers escalate privileges, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-109739

    Firefox - Privilege Escalation

    Firefox contains a privilege escalation vulnerability in the WebExtensions component, letting attackers escalate their privileges, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-109709 No auth

    Firefox - Information Disclosure & Privilege Escalation

    Firefox < 158 and Firefox ESR < 153.5 contain an information disclosure and privilege escalation vulnerability in the Security: Process Sandboxing component, letting attackers gain elevated privileges and access sensitive information, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-109704

    Mozilla Firefox - Privilege Escalation

    Mozilla Firefox contains a privilege escalation vulnerability in the Application Update component, letting attackers escalate their privileges, exploit requires unspecified conditions.

  • 7.6 /10 High
    CVE-2026-109687 Auth required

    Link Whisper INC Link Whisper Free - SQL Injection

    Link Whisper INC Link Whisper Free <= 0.9.7 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.