High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 11 of 725

  • 8.4 /10 High
    CVE-2026-109141 Auth required

    Generic System - Broken Access Control

    A system contains a broken access control vulnerability caused by improper permission assignment to roles restricted to specific CAs, letting attackers create child CAs and ROAs with full permissions, exploit requires ability to send requests to bulk import endpoint.

  • 8.4 /10 High
    CVE-2026-109140

    Krill - Weak Cryptography

    Krill contains a weak cryptography vulnerability caused by reuse of (key, nonce) pairs for encrypting login-session tokens due to nonce counter reset on restart, letting attackers potentially decrypt or forge tokens, exploit requires attacker to observe encrypted tokens across restarts.

  • 7.5 /10 High
    CVE-2026-106808

    OpenAirInterface Core Network - Buffer Overflow

    OpenAirInterface Core Network v2.2.1 contains a stack-based buffer overflow caused by improper validation of resynchronizationInfo.rand and auts in Nudm_UEAU Generate Authentication Data endpoint, letting unauthenticated attackers with SBI interface access and valid SUPI terminate the UDM process.

  • 7.5 /10 High
    CVE-2026-106804 No auth

    Kamailio - Buffer Overflow

    Kamailio v6.1.3 and v6.1.4 contain a stack overflow caused by unchecked copying of the host field from SIP Via header in ims_qos_npn module, letting unauthenticated remote attackers cause denial of service via crafted REGISTER request.

  • 8.6 /10 High
    CVE-2026-105602 Auth required

    Joomla Extension joomshaper.com Helix Ultimate - Stored XSS

    Joomla Extension joomshaper.com Helix Ultimate < 2.2.11 contains a stored cross-site scripting caused by improper sanitization of Mega Menu Badge Text, letting attackers execute scripts in users' browsers, exploit requires user interaction.

  • 8.6 /10 High
    CVE-2026-105600 Auth required

    Joomla Extension php-web-design.com - Remote Code Execution

    Joomla Extension php-web-design.com StageIt 1.0-5.7.5, 6.0-6.3.5 contains a remote code execution caused by setting strings, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-105476 Auth required

    cPanel - Broken Access Control

    cPanel contains a broken access control vulnerability caused by improper link resolution before file access, letting remote authenticated users write arbitrary root-owned files and escalate privileges.

  • 8.7 /10 High
    CVE-2026-105475 No auth

    cPanel - Information Disclosure

    cPanel contains an information disclosure vulnerability caused by improper neutralization of a NUL byte, letting remote attackers read any mail account's calendar and contact data, exploit requires no special privileges.

  • 8.4 /10 High
    CVE-2026-104080 No auth

    Control Web Panel - Command Injection

    Control Web Panel (CWP) < 1.30 contains an OS command injection caused by unvalidated 'user' parameter in /valid_token/ route, letting unauthenticated attackers execute arbitrary commands as root, exploit requires crafted request.

  • 7.2 /10 High
    CVE-2026-103420 No auth

    Joomla Extension php-web-design.com StageIt - Cross Site Request Forgery

    Joomla Extension php-web-design.com StageIt 1.0-5.7.5, 6.0-6.3.5 contains a cross site request forgery caused by lack of proper request validation for various actions, letting attackers perform unauthorized actions, exploit requires victim interaction.

  • 8.6 /10 High
    CVE-2026-103419 Auth required

    Joomla Extension joomshaper.com Helix Ultimate - Stored XSS

    Joomla Extension joomshaper.com Helix Ultimate < 2.2.11 contains a stored cross-site scripting caused by improper input sanitization in Media Picker, letting attackers execute scripts in users' browsers, exploit requires no special conditions.

  • 8.9 /10 High
    CVE-2026-102802

    Joomla Extension regularlabs.com - Command Injection

    Joomla Extension regularlabs.com Sourcerer < 17.0.1 used with Articles Anywhere < 20.1.1 contains a PHP code injection caused by improper trust evaluation in article inclusion, letting attackers execute PHP code with elevated article-author privileges, exploit requires specific extension combination and configuration.

  • 7.5 /10 High
    CVE-2026-101186 No auth

    window module - Denial of Service

    window module contains a denial of service vulnerability caused by unspecified issue, letting attackers affect system availability, exploit requires no special conditions.

  • 7.1 /10 High
    CVE-2026-101176

    Unknown Product - Broken Access Control

    An unspecified product contains a broken access control vulnerability in the event notification management module, letting attackers affect service confidentiality, exploit requires unspecified conditions.

  • 7.6 /10 High
    CVE-2026-95863 No auth

    Apache Wicket - Stored XSS

    Apache Wicket 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 contain a stored XSS caused by improper escaping of component and markup IDs in JavaScript contexts, letting attackers execute script in the application's origin, exploit requires attacker-controlled component or markup IDs.