High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 107 of 552

  • 8.8 /10 High
    CVE-2026-109676 No auth

    FreeRDP - Use After Free

    FreeRDP > 3.0.0-beta1 < 3.32.0 contains a use-after-free vulnerability caused by invalid smartcard connect operation in smartcard handling, letting attackers cause memory corruption or crashes, exploit requires triggering invalid connect.

  • 7.3 /10 High
    CVE-2026-109620 No auth

    SourceCodester Online Reviewer System - SQL Injection

    SourceCodester Online Reviewer System 1.0 contains a SQL injection caused by manipulation of username/password arguments in PDO::prepare in login/index.php, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-109607 No auth

    SourceCodester Online Exam System - SQL Injection

    SourceCodester Online Exam System 1.0 contains a SQL injection caused by manipulation of "username" and "pass" arguments in adminpanel/admin/query/loginExe.php Login Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-109606 No auth

    SourceCodester Art Gallery Management System - SQL Injection

    SourceCodester Art Gallery Management System 1.0 contains a SQL injection caused by manipulation of the "Name" argument in Action::save_user function in admin/admin_class.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-109605 No auth

    SourceCodester Simple Cafe Billing System - Broken Access Control

    SourceCodester Simple Cafe Billing System 1.0 contains a broken access control caused by manipulation of the "Type" argument in Action::save_user function in admin_class.php, letting remote attackers bypass authorization, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-109525 No auth

    girishsaraf Online-Appointment-Booking-System - Broken Access Control

    girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 contains a broken access control caused by manipulation of username[], timestamp[], and status[] arguments in changebookingstatus.php submit2 Handler, letting remote attackers bypass authorization, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-109523 No auth

    girishsaraf Online-Appointment-Booking-System - SQL Injection

    girishsaraf Online-Appointment-Booking-System contains a SQL injection caused by manipulation of "city/cid" argument in Admin/getclinic.php AJAX Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-109522 No auth

    girishsaraf Online-Appointment-Booking-System - SQL Injection

    girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 contains a SQL injection caused by manipulation of "cid" and "did" arguments in Admin/deleteclinic.php Admin CRUD Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-109521 No auth

    girishsaraf Online-Appointment-Booking-System - SQL Injection

    girishsaraf Online-Appointment-Booking-System contains a SQL injection caused by manipulation of the "dateselected" argument in changebookingstatus.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-109520 Auth required

    Colorful iGameCenter - Privilege Escalation

    Colorful iGameCenter 2.0.0.82 contains a privilege escalation caused by manipulation of the SystemBuffer argument in MmMapIoSpace function of AMDRyzenMasterDriver.sys Dispatch Handler, letting local attackers escalate privileges, exploit requires local access.

  • 8.3 /10 High
    CVE-2026-109519 PoC publicNo auth

    YouTransfer - Path Traversal

    YouTransfer <= 0.0.7/1.0.6/1.1.0 contains a path traversal caused by manipulation in /settings/template Template Rendering component, letting remote attackers access arbitrary files, exploit requires no special privileges.

  • 7.0 /10 High
    CVE-2026-109453 Auth required

    Virtual Hard Disk Miniport Driver - Privilege Escalation

    Virtual Hard Disk (VHD) Miniport Driver contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.

  • 8.8 /10 High
    CVE-2026-109429 No auth

    Mistral Vibe - Command Injection

    Mistral Vibe < 2.25.4 contains a command permission gate bypass caused by hidden command substitution inside single-quoted variable undetected by tree-sitter-bash static parsing, letting attackers execute arbitrary commands with agent terminal privileges, exploit requires crafted input with bash promptvars feature.

  • 8.8 /10 High
    CVE-2026-109428 No auth

    Mistral Vibe - Broken Access Control

    Mistral Vibe < 2.25.5 contains a permission validation bypass caused by parsing discrepancies between tree-sitter-bash and bash in _extract_commands() function, letting attackers execute unauthorized arbitrary commands, exploit requires crafted command strings.

  • 7.3 /10 High
    CVE-2026-109405 No auth

    conductor-oss conductor - Server-Side Request Forgery

    conductor-oss conductor <= 3.33.0-rc10 contains a server-side request forgery caused by manipulation of the kafka_request.bootStrapServers argument in KafkaPublishTask.start, letting remote attackers make arbitrary outbound requests, exploit requires network access.