High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 144 of 556
- 8.6 /10 HighCVE-2026-81420 No auth
Tcard WP WordPress plugin - SQL Injection
Tcard WP WordPress plugin through 1.8.0 contains a sql injection caused by unsanitized and unescaped parameter in an unauthenticated AJAX action, letting unauthenticated attackers execute arbitrary SQL commands remotely.
- 7.5 /10 HighCVE-2026-19935 No auth
Zephyr Bluetooth LE - Use After Free
Zephyr Bluetooth LE host contains a use-after-free caused by improper cancellation of deferred L2CAP channel RX work in l2cap_chan_destroy(), letting remote unauthenticated peers with established CoC channels cause memory corruption or denial of service, exploit requires an established CoC channel.
- 7.8 /10 HighCVE-2026-19736 Auth required
NXP MCUX TRNG - Buffer Overflow
NXP MCUX TRNG entropy driver in affected i.MX RT5xx and RT6xx devices contains a buffer overflow caused by improper handling of non-word-multiple byte requests in TRNG_GetRandomData(), letting unprivileged user-mode threads or kernel callers cause memory corruption beyond the buffer, exploit requires unprivileged access to entropy device or kernel mode call.
- 7.8 /10 HighCVE-2026-19669 Auth required
Zephyr Fuel Gauge - Buffer Overflow
Zephyr drivers/fuel_gauge contains a buffer overflow caused by unvalidated variable-length arrays sized by attacker-controlled len in syscall verifiers, letting user-mode attackers with device access execute kernel code or crash the system, exploit requires user-mode access with CONFIG_USERSPACE enabled and fuel-gauge device permissions.
- 7.1 /10 HighCVE-2026-19577 No auth
Zephyr Project - Out of Bounds Read
Zephyr Project contains an out-of-bounds read vulnerability in net_route_ipv6_packet() caused by improper neighbor cache link-layer address validation, letting unauthenticated attackers on the same link cause denial of service or information disclosure, exploit requires attacker to send crafted packets to unresolved neighbors.
- 7.5 /10 HighCVE-2026-14854 No auth
WooCommerce Bookings - Denial of Service
WooCommerce Bookings WordPress plugin < 3.11.0 contains a denial of service caused by lack of input validation in unauthenticated AJAX actions, letting unauthenticated attackers exhaust server memory with a single request.
- 7.8 /10 HighCVE-2026-108976 Auth required
GNU Emacs - Command Injection
GNU Emacs before 31.2 and TRAMP through 2.8.2 contain a command injection caused by an incomplete list of disallowed inputs in tramp-user-regexp, letting attackers execute OS commands via crafted filenames, exploit requires crafted filename input.
- 8.8 /10 HighCVE-2026-108963 Auth required
Databasement - Remote Code Execution
Databasement < 1.8.2 contains a command injection caused by unsanitized database name passed to OS commands like mariadb-dump, letting authenticated users execute arbitrary code remotely, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-108913 No auth
Omarchy - Remote Code Execution
Omarchy 4 < 4.0.1 contains a remote code execution caused by inclusion of executable content from untrusted third-party themes in ~/.local/state/omarchy/current/theme, letting attackers execute arbitrary code remotely, exploit requires untrusted theme installation.
- 7.5 /10 HighCVE-2026-108905 No auth
pH7Builder - Authentication Bypass
pH7Builder before 18.6.0 contains a hardcoded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header, letting attackers retrieve sensitive member information, exploit requires sending Host header with specific key.
- 8.1 /10 HighCVE-2026-108902 Auth required
pH7Builder - Path Traversal
pH7Builder (pH7 Social Dating CMS) < 18.5.0 contains a path traversal caused by improper validation of the picture_link parameter in the picture module deletePhoto() action, letting authenticated members delete arbitrary files.
- 8.2 /10 HighCVE-2026-108865 No auth
AmoyLab Unla - Authentication Bypass
AmoyLab Unla <= 0.10.0 contains an authentication bypass caused by the OAuth2 server not authenticating resource owners, letting unauthenticated attackers obtain valid access tokens and access protected resources, exploit requires attacker to register a client.
- 7.5 /10 HighCVE-2026-108863 No auth
Katanemo Plano - Authentication Bypass
Katanemo Plano <= 0.4.37 contains a broken authentication caused by missing authentication on Envoy admin interface bound to all host interfaces on port 9901, letting unauthenticated network attackers read LLM provider API keys via /config_dump endpoint.
- 7.5 /10 HighCVE-2026-108859 No auth
mcp-go - Denial of Service
mcp-go <= 1.2.1 contains a denial of service caused by memory exhaustion in StreamableHTTPServer.ServeHTTP due to reading oversized POST bodies before validation, letting remote unauthenticated attackers degrade or crash the server.
- 8.1 /10 HighCVE-2026-108853 Auth required
UnicomAI Wanwu - Broken Access Control
UnicomAI Wanwu < 0.6.3 contains an insecure direct object reference vulnerability caused by insufficient access control in DELETE /v1/appspace/app, letting authenticated low-privileged users delete other tenants' applications and data, exploit requires authentication with low privileges.