High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 14 of 552
- 8.2 /10 HighCVE-2026-102463 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contain a denial of service caused by unbounded array allocation in vertx-pg-client's binary array decoder, letting attackers crash the client via OutOfMemoryError, exploit requires attacker to control or intercept PostgreSQL server responses.
- 8.2 /10 HighCVE-2026-102462 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains an out-of-memory vulnerability caused by unbounded aggregation of inbound TDS packets in the Vert.x MSSQL client, letting malicious or man-in-the-middle SQL Servers cause client crashes before authentication completes.
- 8.7 /10 HighCVE-2026-102461 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains a denial of service caused by inefficient uniqueItems keyword validation in io.vertx:vertx-json-schema, letting remote unauthenticated attackers consume excessive CPU, exploit requires sending a moderately-sized JSON array.
- 7.0 /10 HighCVE-2026-101311 Auth required
bhyve - Remote Code Execution & Denial of Service
bhyve contains a race condition and improper validation in framebuffer and RFB modules, letting a malicious guest crash the bhyve process or execute arbitrary code in host userspace, exploit requires guest VM access.
- 7.5 /10 HighCVE-2026-101290 No auth
Affected Application - Denial of Service
An affected application contains an out-of-bounds read caused by insufficient validation of packet length, letting remote attackers cause denial-of-service by crashing the application, exploit requires crafted network packet.
- 7.5 /10 HighCVE-2026-0993 No auth
SODOLA SL902-SWTGW124AS - Denial of Service
SODOLA SL902-SWTGW124AS firmware < 200.2.12 contains a buffer overflow caused by an oversized boundary value in the Content-Type header of a multipart/form-data POST request, letting unauthenticated remote attackers cause denial of service.
- 7.5 /10 HighCVE-2025-68404 No auth
QuRouter - Race Condition
QuRouter contains a time-of-check time-of-use (TOCTOU) race condition vulnerability, letting remote attackers compromise system security, exploit requires no special privileges.
- 7.7 /10 HighCVE-2025-66275 Auth required
Video Station - Path Traversal
Video Station < 5.8.5 contains a path traversal caused by insufficient validation of file paths, letting remote attackers with user accounts read arbitrary files, exploit requires user authentication.
- 7.7 /10 HighCVE-2025-66272 Auth required
Video Station - Path Traversal
Video Station < 5.8.5 contains a path traversal caused by insufficient input validation, letting remote attackers with user accounts read arbitrary files, exploit requires attacker to have a user account.
- 8.5 /10 HighCVE-2024-22031 Auth required
Rancher - Broken Access Control
Rancher contains a broken access control vulnerability caused by allowing project creation with duplicate names across clusters, letting users escalate privileges by accessing projects in different clusters, exploit requires project creation ability.
- 8.0 /10 HighCVE-2023-32198 Auth required
Steve - Man-in-the-Middle
Steve contains a man-in-the-middle vulnerability caused by using an insecure TLS option that does not validate remote server certificates, letting attackers intercept and modify communications, exploit requires network access.
- 7.5 /10 HighCVE-2026-109468 No auth
ASP.NET Core - Denial of Service
ASP.NET Core contains a denial of service vulnerability caused by allocation of resources without limits or throttling, letting unauthorized attackers exhaust resources remotely, exploit requires network access.
- 8.1 /10 HighCVE-2026-55587 No auth
AliasVault - Authentication Bypass
AliasVault browser extension < 0.29.4 contains an authentication bypass caused by lack of origin and relying-party identifier verification in passkey requests, letting attackers obtain valid assertions for different websites, exploit requires extension installed, unlocked, configured, and user approval.
- 8.7 /10 HighCVE-2026-104150 No auth
AdonisJS HTTP Server - Denial of Service
AdonisJS HTTP Server < 8.2.2 and < 9.1.1 contains a denial of service caused by adjacent greedy repetitions with overlapping character classes in router.matchers.slug(), letting attackers cause excessive CPU use and block event loop, exploit requires attacker-controlled route parameter.
- 7.1 /10 HighCVE-2026-105065 No auth
8theme.com XStore - Reflected XSS
8theme.com XStore < 9.7.9 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires no special privileges.