High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 138 of 556

  • 7.3 /10 High
    CVE-2026-109290 Auth required

    Open WebUI - Stored XSS

    Open WebUI >0.11.1 <0.11.4 contains a stored cross-site scripting caused by crafted DOCX attachments in DocxPreview.svelte, letting authenticated attackers execute scripts to steal admin session tokens.

  • 8.1 /10 High
    CVE-2026-109286 No auth

    Open WebUI - Cross-Site Request Forgery

    Open WebUI >0.7.0 <0.11.4 contains a cross-origin message handling vulnerability caused by unvalidated verify:chat messages in SyncStatsModal, letting remote attackers steal session tokens, exploit requires crafted cross-origin messages.

  • 7.1 /10 High
    CVE-2026-109242 No auth

    FreeRDP - Information Disclosure & Denial of Service

    FreeRDP < 3.0.0 and 3.6.0 < 3.32.0 contain an information disclosure and denial of service caused by uninitialized heap memory rendering in progressive tiles, letting malicious RDP servers leak memory or crash clients, exploit requires malicious server interaction.

  • 8.6 /10 High
    CVE-2026-109238 No auth

    Crawl4AI - Server-Side Request Forgery

    Crawl4AI < 0.9.4 contains a server-side request forgery caused by enabling link_preview_config on /crawl requests, letting API clients access internal addresses, exploit requires crafted API requests with specific parameters.

  • 8.1 /10 High
    CVE-2026-109237 Auth required

    Crawl4AI - Authentication Bypass

    Crawl4AI 0.9.0 before 0.9.4 contains an untrusted-config gate bypass caused by wrapping forbidden config objects in dict-type wrappers, letting non-admin API clients read secret keys and forge admin JWTs, exploit requires non-admin API access.

  • 7.5 /10 High
    CVE-2026-109229 No auth

    SGLang - Denial of Service

    SGLang through 0.5.21 contains a denial of service vulnerability caused by disabling Pillow decompression bomb protection in NanoNemotronVLImageProcessor, letting remote attackers exhaust memory by submitting highly compressed large images, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-109228 No auth

    SGLang - Denial of Service

    SGLang through 0.5.21 contains a denial of service caused by resource budget bypass via manipulation of fps, max_frames, max_tokens_per_frame, and max_image_tokens in video_url, letting remote attackers exhaust worker memory, exploit requires crafted video_url parameters.

  • 7.5 /10 High
    CVE-2026-109227 No auth

    SGLang - Denial of Service

    SGLang through 0.5.21 contains a denial of service caused by unbounded memory allocation in preprocess_video in qwen_vl.py, letting remote attackers exhaust worker memory by submitting high-resolution videos, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-109226 No auth

    SGLang - Denial of Service

    SGLang <= 0.5.21 contains a denial of service vulnerability caused by decompression amplification in load_audio, letting remote attackers exhaust memory and CPU by submitting highly compressed audio without duration or sample limits.

  • 7.5 /10 High
    CVE-2026-109225 No auth

    SGLang - Denial of Service

    SGLang <= 0.5.21 contains a denial of service vulnerability caused by unbounded memory allocation in /v1/audio/transcriptions, letting unauthenticated remote attackers exhaust memory and crash the service, exploit requires uploading oversized files concurrently.

  • 7.5 /10 High
    CVE-2026-109205 No auth

    LogicalDOC Community Edition - Unrestricted File Upload

    LogicalDOC Community Edition through 9.3 contains an unrestricted file upload vulnerability in UploadServlet, letting unauthenticated remote attackers write files to disk and exhaust server disk space, exploit requires no authentication.

  • 8.3 /10 High
    CVE-2026-109201 Auth required

    LogicalDOC Community Edition - Broken Access Control

    LogicalDOC Community Edition through 9.3 contains a broken access control vulnerability in SoapDocumentService operations, letting authenticated users access and modify unauthorized documents via SOAP or REST endpoints.

  • 8.8 /10 High
    CVE-2026-109199 Auth required

    LogicalDOC Community Edition - Command Injection

    LogicalDOC Community Edition through 9.3 contains a command injection caused by submission of malicious Velocity templates in DocumentService.sendAsEmail subject or message fields, letting authenticated users execute OS commands with LogicalDOC process privileges.

  • 8.8 /10 High
    CVE-2026-109186 Auth required

    jshERP - Broken Access Control

    jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler, letting authenticated users overwrite protected fields like tenant_id and password, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-109185 Auth required

    jshERP - Broken Access Control

    jshERP through 3.6 contains a broken access control vulnerability caused by missing authorization in UserController updateUser handler, letting authenticated users assign arbitrary roles to escalate privileges, exploit requires authentication.