High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 139 of 556

  • 7.1 /10 High
    CVE-2026-109164 Auth required

    TDuck survey form - Broken Access Control

    TDuck survey form through 6.0 contains an insecure direct object reference vulnerability caused by insufficient access control on submission deletion, letting authenticated users delete other users' submissions by supplying arbitrary submission IDs.

  • 7.1 /10 High
    CVE-2026-108985 No auth

    libnfs - Buffer Overflow

    libnfs <= 6.0.2 before commit 7613236 contains a buffer overflow caused by improper handling of caller-supplied maxsize in ZDR decoding functions libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(), letting attackers cause memory corruption remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-108982 Auth required

    VeraCrypt - Broken Access Control

    VeraCrypt 1.26.29 (FUSE-T build) on macOS contains an information disclosure vulnerability caused by failure to terminate auxiliary services after volume dismount, letting local users access decrypted data without passphrase, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-108980 Auth required

    Blinko - Path Traversal & Remote Code Execution

    Blinko through 1.8.8 contains a path traversal caused by unsanitized plugin name in server/routerTrpc/plugin.ts, letting authenticated users overwrite root-owned startup files and achieve remote code execution as root, exploit requires user authentication.

  • 7.8 /10 High
    CVE-2026-108953 Auth required

    mac-shell-mcp - Command Injection

    mac-shell-mcp < 2.0.0 contains a command injection caused by injection of shell metacharacters into execute_command arguments, letting attackers bypass command whitelist and execute arbitrary OS commands as server user, exploit requires attacker to send crafted execute_command arguments.

  • 7.3 /10 High
    CVE-2026-108921 No auth

    KusalkaSilva Learning-Management-System - Authentication Bypass

    KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 contains a broken authentication caused by manipulation of the "ID" argument in mysql_query of remove_announcements.php, letting remote attackers bypass authentication, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-108916 No auth

    Edimax BR-6208AC - Command Injection

    Edimax BR-6208AC 1.32 contains a command injection caused by manipulation of the "submit-url" argument in /goform/formAccept, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-108906 Auth required

    Netcore NR268 - Out of Bounds Read

    Netcore NR268 1.7.121109 contains an out-of-bounds read caused by manipulation of the "put_file" argument in /router/filter_arp_put_file.cgi, letting remote attackers read memory out of bounds, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-108900 No auth

    Exponent CMS - SQL Injection

    Exponent CMS <= 3.0.2patch2 contains a SQL injection caused by manipulation in userLogin function of xmlrpc.php XML-RPC component, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-108899 No auth

    tobychui zoraxy - Broken Access Control

    tobychui zoraxy <= 3.3.4 contains a broken access control caused by improper authorization in handleBasicAuth function of Path Exception Matcher, letting remote attackers bypass authorization, exploit requires crafted PathPrefix argument.

  • 7.3 /10 High
    CVE-2026-108836 No auth

    Ollama - Server Side Request Forgery

    Ollama <= 0.34.1 contains a server-side request forgery caused by manipulation in the IsValid function of Pull API, letting remote attackers initiate SSRF, exploit requires network access.

  • 7.3 /10 High
    CVE-2026-108826 No auth

    Zen Cart - SQL Injection

    Zen Cart <= 2.2.2 contains a SQL injection caused by manipulation of the "txn_id" argument in zen_db_perform function of includes/modules/payment/paypaldp.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-108819 No auth

    agno-agi agno - Command Injection

    agno-agi agno <= 3.0.6/3.1.1 contains a command injection caused by manipulation of the "code" argument in Agent Orchestration Layer exec function, letting remote attackers execute arbitrary code, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-108818 No auth

    agno-agi agno - Authentication Bypass

    agno-agi agno <= 2.7.3/3.0.6 contains an authentication bypass caused by manipulation of the "security_key" argument in get_authentication_dependency function of auth.py, letting remote attackers bypass authentication, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-108807 No auth

    krupalshah EmployeeRecruitmentSystem - SQL Injection

    krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe contains an SQL injection caused by manipulation of input in mysql_query function in source/adminregister.php Registration Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.