High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 131 of 552

  • 8.1 /10 High
    CVE-2026-109633 No auth

    Frappe ERPNext - Stored XSS

    Frappe ERPNext < 15.119.1 and 16.x < 16.32.0 contains a stored XSS caused by unneutralized content submitted through a public booking page, letting unauthenticated attackers execute scripts in privileged user sessions.

  • 7.1 /10 High
    CVE-2026-109617 Auth required

    Frappe ERPNext - Broken Access Control

    Frappe ERPNext < 15.121.0 and 16.x < 16.34.0 contains a broken access control vulnerability caused by missing authorization checks in certain endpoints during document creation, letting authenticated low-privileged users bypass role-based permissions to create unauthorized documents.

  • 7.1 /10 High
    CVE-2026-109616 Auth required

    Frappe ERPNext - Broken Access Control

    Frappe ERPNext < 15.121.3 and 16.x < 16.35.0 contains a broken access control vulnerability caused by missing authorization checks in certain endpoints, letting authenticated users modify data beyond their role permissions.

  • 7.1 /10 High
    CVE-2026-109613 Auth required

    Frappe ERPNext - Broken Access Control

    Frappe ERPNext < 15.121.0 and 16.x < 16.34.0 contains a broken access control vulnerability caused by missing authorization checks on document status modification endpoints, letting authenticated low-privileged users modify data beyond their roles, exploit requires authentication with low privileges.

  • 7.3 /10 High
    CVE-2026-109612 Auth required

    Frappe ERPNext - Stored XSS

    Frappe ERPNext < 15.120.0 and 16.x < 16.33.0 contains a stored XSS caused by unescaped interpolation of stored record names in report view, letting authenticated users execute scripts in other users' sessions, exploit requires authenticated user to create records.

  • 8.8 /10 High
    CVE-2026-109608 Auth required

    Frappe ERPNext - SQL Injection

    Frappe ERPNext < 15.121.0 and 16.x < 16.34.0 contains an SQL injection caused by lack of input validation in several endpoints, letting authenticated users read sensitive information and escalate privileges, exploit requires authentication.

  • 7.3 /10 High
    CVE-2026-109604 Auth required

    Frappe ERPNext - Stored XSS

    Frappe ERPNext < 15.112.0 and 16.x < 16.23.0 contains a stored XSS caused by unescaped interpolation of stored record names in a tool view, letting authenticated users execute scripts in other users' sessions.

  • 8.1 /10 High
    CVE-2026-109573 No auth

    phpMyFAQ - SQL Injection

    phpMyFAQ < 4.1.9 contains an SQL injection caused by improper escaping in PdoMysql::escape() under NO_BACKSLASH_ESCAPES mode, letting unauthenticated attackers read, modify, or delete database records via api/autocomplete search parameter.

  • 7.6 /10 High
    CVE-2026-109572 Auth required

    Open WebUI - Privilege Escalation

    Open WebUI >0.8.6 <0.11.4 contains a privilege escalation caused by shared key exposure in terminal proxy, letting authenticated users access Terminals administrator API to control other users' terminals, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-109569 Auth required

    sandboxed.sh - Container Escape

    sandboxed.sh <= 1.3.0 contains a container escape vulnerability caused by nsenter attaching without --root, letting agent-run code in container workspaces read and modify host filesystem, exploit requires agent code execution in container.

  • 7.1 /10 High
    CVE-2026-109568 Auth required

    Shaark - Broken Access Control

    Shaark 1.2.13 through 1.2.44 contains a broken access control vulnerability caused by missing ownership checks in Link, Story, Chest, and Album API controllers, letting authenticated non-admin users overwrite or delete other users' content via PUT or DELETE requests.

  • 7.2 /10 High
    CVE-2026-109567 Auth required

    Rapyd Admin - Broken Access Control

    Rapyd Admin 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component, letting users with edit users permission assign themselves the admin role, exploit requires edit users permission.

  • 7.5 /10 High
    CVE-2026-109563 No auth

    N3.js - Denial of Service

    N3.js < 2.11.1 contains a regular expression denial of service caused by quadratic backtracking in N3Lexer number pattern, letting attackers supply crafted input to block the Node.js event loop, exploit requires attacker to provide untrusted input.

  • 7.5 /10 High
    CVE-2026-109560 No auth

    Continue CLI - Permission Bypass

    Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass caused by chaining unapproved commands after allowed Bash prefix rules, letting attackers execute arbitrary code as the user, exploit requires command injection via repository files or fetched pages.

  • 8.7 /10 High
    CVE-2026-109559 Auth required

    EdgeEver Desktop - Broken Access Control

    EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass caused by string-prefix URL matching in the main window, letting attackers load arbitrary origins and access session tokens, exploit requires crafted URL with userinfo syntax.