High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 130 of 552

  • 7.5 /10 High
    CVE-2026-1907 Auth required

    Kong Gateway - SQL Injection

    Kong Gateway (Enterprise and Open Source) contains a sql injection caused by specially crafted RPC requests in clustering communication logic in Hybrid Mode, letting attackers access unauthorized database data, exploit requires network access and valid client certificate and key.

  • 8.7 /10 High
    CVE-2026-18537 Auth required

    IBM Maximo Application Suite - Improper Input Validation

    IBM Maximo Application Suite Location Service for Esri Component 9.2, 9.1, and 9.0 contains an improper input validation vulnerability caused by an unsanitised container image reference in a Kubernetes operator template, letting attackers potentially manipulate input, exploit requires crafted input.

  • 8.7 /10 High
    CVE-2026-18529 Auth required

    IBM Maximo Application Suite - Location Service for Esri Component - Command Injection

    IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 contains a command injection caused by improper sanitisation of user-controlled input in a Kubernetes operator task, letting attackers execute arbitrary commands remotely, exploit requires network access.

  • 7.7 /10 High
    CVE-2026-18517 Auth required

    IBM Maximo Application Suite - Location Service for Esri Component - Misconfiguration

    IBM Maximo Application Suite - Location Service for Esri Component 9.0, 9.1, and 9.2 contains a misconfiguration in Kubernetes NetworkPolicy causing unintended network egress, letting attackers potentially access unauthorized network resources, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-18513 Auth required

    IBM Maximo Application Suite - Broken Access Control

    IBM Maximo Application Suite Location Service for Esri Component 9.2, 9.1, and 9.0 contains an improper access control vulnerability caused by a schema-less Custom Resource Definition, letting attackers bypass access restrictions, exploit requires no special privileges.

  • 7.8 /10 High
    CVE-2026-18390 No auth

    Ministry of Justice General Directorate of Information Technology UYAP Document Editor - OS Command Injection

    Ministry of Justice General Directorate of Information Technology UYAP Document Editor < 5.4.20 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.

  • 7.7 /10 High
    CVE-2026-18166 Auth required

    IBM Db2 - Information Disclosure

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows contains an information disclosure vulnerability caused by improper authorization in the CREATE WRAPPER command, letting remote authenticated attackers obtain sensitive information.

  • 7.1 /10 High
    CVE-2026-17475 Auth required

    IBM Planning Analytics - Broken Access Control

    IBM Planning Analytics 2.0 and 2.1 contain a broken access control caused by improper functional level access control, letting remote authenticated attackers delete folders and applications of other users, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-12613 No auth

    Ministry of Justice General Directorate of Information Technology UYAP Document Editor - Insecure Deserialization

    Ministry of Justice General Directorate of Information Technology UYAP Document Editor < 5.4.20 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-109673 Auth required

    Frappe ERPNext - Stored XSS

    Frappe ERPNext < 15.103.0 and 16.x < 16.12.0 contains a stored XSS caused by improper neutralization of record names in dashboards, tools, and portals, letting authenticated attackers execute scripts in other users' browsers.

  • 7.3 /10 High
    CVE-2026-109671 Auth required

    Frappe ERPNext - Stored XSS

    Frappe ERPNext < 15.113.0 and 16.x < 16.24.0 contains a stored XSS caused by unescaped profile field rendering in portal pages, letting low-privilege attackers execute scripts in administrator browsers, exploit requires low-privilege access.

  • 8.8 /10 High
    CVE-2026-109667 Auth required

    Frappe ERPNext - Privilege Escalation

    Frappe ERPNext < 15.111.0 and 16.x < 16.22.0 contains a privilege escalation caused by disabled permission checks in a record-creation endpoint, letting authenticated users create privileged accounts and take full control, exploit requires authentication.

  • 7.3 /10 High
    CVE-2026-109653 Auth required

    Frappe ERPNext - Stored XSS

    Frappe ERPNext < 15.119.0 and 16.x < 16.31.0 contains a stored XSS caused by unescaped record fields rendered in HTML attribute context, letting low-privilege users execute scripts in privileged users' browsers, exploit requires low-privilege user access.

  • 8.8 /10 High
    CVE-2026-109652 Auth required

    Frappe ERPNext - Server-Side Template Injection

    Frappe ERPNext < 15.119.1 and 16.x < 16.32.0 contains a server-side template injection caused by unvalidated user-controlled message fields in template rendering, letting authenticated attackers with common operational roles execute arbitrary template expressions to read/write database data, delete documents, send outbound requests, and send mail.

  • 8.1 /10 High
    CVE-2026-109640 Auth required

    Frappe ERPNext - Broken Access Control

    Frappe ERPNext < 16.22.0 contains a broken access control vulnerability caused by missing authorization checks in certain endpoints, letting authenticated users modify records beyond their permitted roles.