High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 135 of 552
- 7.5 /10 HighCVE-2026-109227 No auth
SGLang - Denial of Service
SGLang through 0.5.21 contains a denial of service caused by unbounded memory allocation in preprocess_video in qwen_vl.py, letting remote attackers exhaust worker memory by submitting high-resolution videos, exploit requires network access.
- 7.5 /10 HighCVE-2026-109226 No auth
SGLang - Denial of Service
SGLang <= 0.5.21 contains a denial of service vulnerability caused by decompression amplification in load_audio, letting remote attackers exhaust memory and CPU by submitting highly compressed audio without duration or sample limits.
- 7.5 /10 HighCVE-2026-109225 No auth
SGLang - Denial of Service
SGLang <= 0.5.21 contains a denial of service vulnerability caused by unbounded memory allocation in /v1/audio/transcriptions, letting unauthenticated remote attackers exhaust memory and crash the service, exploit requires uploading oversized files concurrently.
- 7.5 /10 HighCVE-2026-109205 No auth
LogicalDOC Community Edition - Unrestricted File Upload
LogicalDOC Community Edition through 9.3 contains an unrestricted file upload vulnerability in UploadServlet, letting unauthenticated remote attackers write files to disk and exhaust server disk space, exploit requires no authentication.
- 8.3 /10 HighCVE-2026-109201 Auth required
LogicalDOC Community Edition - Broken Access Control
LogicalDOC Community Edition through 9.3 contains a broken access control vulnerability in SoapDocumentService operations, letting authenticated users access and modify unauthorized documents via SOAP or REST endpoints.
- 8.8 /10 HighCVE-2026-109199 Auth required
LogicalDOC Community Edition - Command Injection
LogicalDOC Community Edition through 9.3 contains a command injection caused by submission of malicious Velocity templates in DocumentService.sendAsEmail subject or message fields, letting authenticated users execute OS commands with LogicalDOC process privileges.
- 8.8 /10 HighCVE-2026-109186 Auth required
jshERP - Broken Access Control
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler, letting authenticated users overwrite protected fields like tenant_id and password, exploit requires authentication.
- 8.8 /10 HighCVE-2026-109185 Auth required
jshERP - Broken Access Control
jshERP through 3.6 contains a broken access control vulnerability caused by missing authorization in UserController updateUser handler, letting authenticated users assign arbitrary roles to escalate privileges, exploit requires authentication.
- 7.1 /10 HighCVE-2026-109164 Auth required
TDuck survey form - Broken Access Control
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability caused by insufficient access control on submission deletion, letting authenticated users delete other users' submissions by supplying arbitrary submission IDs.
- 7.1 /10 HighCVE-2026-108985 No auth
libnfs - Buffer Overflow
libnfs <= 6.0.2 before commit 7613236 contains a buffer overflow caused by improper handling of caller-supplied maxsize in ZDR decoding functions libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(), letting attackers cause memory corruption remotely, exploit requires crafted input.
- 7.2 /10 HighCVE-2026-108982 Auth required
VeraCrypt - Broken Access Control
VeraCrypt 1.26.29 (FUSE-T build) on macOS contains an information disclosure vulnerability caused by failure to terminate auxiliary services after volume dismount, letting local users access decrypted data without passphrase, exploit requires local access.
- 8.8 /10 HighCVE-2026-108980 Auth required
Blinko - Path Traversal & Remote Code Execution
Blinko through 1.8.8 contains a path traversal caused by unsanitized plugin name in server/routerTrpc/plugin.ts, letting authenticated users overwrite root-owned startup files and achieve remote code execution as root, exploit requires user authentication.
- 7.8 /10 HighCVE-2026-108953 Auth required
mac-shell-mcp - Command Injection
mac-shell-mcp < 2.0.0 contains a command injection caused by injection of shell metacharacters into execute_command arguments, letting attackers bypass command whitelist and execute arbitrary OS commands as server user, exploit requires attacker to send crafted execute_command arguments.
- 7.3 /10 HighCVE-2026-108921 No auth
KusalkaSilva Learning-Management-System - Authentication Bypass
KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 contains a broken authentication caused by manipulation of the "ID" argument in mysql_query of remove_announcements.php, letting remote attackers bypass authentication, exploit requires no special privileges.
- 8.3 /10 HighCVE-2026-108916 No auth
Edimax BR-6208AC - Command Injection
Edimax BR-6208AC 1.32 contains a command injection caused by manipulation of the "submit-url" argument in /goform/formAccept, letting remote attackers execute arbitrary commands, exploit requires no special privileges.