High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 158 of 556
- 8.8 /10 HighCVE-2026-93548 Auth required
FooSales WordPress plugin - Broken Access Control
FooSales WordPress plugin < 1.43.3 contains a broken access control vulnerability caused by lack of verification of user entitlement, letting authenticated users act as arbitrary other users including administrators, exploit requires authentication.
- 7.8 /10 HighCVE-2026-92705 No auth
Aegisub - Remote Code Execution
Aegisub 3.2.0 to 3.4.2 contains a remote code execution caused by automatic loading of untrusted Automation scripts referenced in ASS subtitle projects, letting attackers execute arbitrary code with Aegisub process privileges, exploit requires opening a crafted ASS file.
- 8.2 /10 HighCVE-2026-90983 No auth
Hayat Health Facilities Inc. Hayat Mobile - Authentication Bypass
Hayat Health Facilities Inc. Hayat Mobile 3.3.0 to before 3.4.0 contains an authentication bypass caused by use of client-side authentication, letting attackers bypass authentication, exploit requires no special conditions.
- 8.5 /10 HighCVE-2026-8374
SwitchBot Door Lock Series - Authentication Bypass
SwitchBot Door Lock Series contains an authentication bypass caused by misuse and misconfiguration in Bluetooth communication, letting attackers bypass electronic lock and access controls via manipulated protocol, exploit requires proximity to the device.
- 7.2 /10 HighCVE-2026-81929 No auth
Ocean Pro Demos & Ocean eComm Treasure Box - Stored XSS
Ocean Pro Demos and Ocean eComm Treasure Box WordPress plugins <= 1.5.4 and 1.8.0 contain a stored cross-site scripting caused by insufficient authorization, input sanitization, and output escaping in Popup Builder's save_popup_content AJAX action, letting unauthenticated attackers inject scripts into published Gutenberg popups, exploit requires valid premium license, Popup Builder module, and published popup.
- 7.5 /10 HighCVE-2026-78795 No auth
Netcore B11 - Information Disclosure
Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router <= v1.3.241114.024540 contains an information disclosure vulnerability allowing remote attackers to obtain sensitive information without authentication.
- 8.1 /10 HighCVE-2026-7827 No auth
FalkorDB - Buffer Overflow
FalkorDB < 4.18.4 contains a stack-based buffer overflow caused by improper bounds checking in _RdbLoadEntity function of RDB graph decoders, letting remote attackers issuing Redis replication commands cause denial of service or remote code execution by supplying crafted RDB streams.
- 7.5 /10 HighCVE-2026-78025 No auth
Dell Secure Connect Gateway Policy Manager - Authentication Bypass
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains a missing authentication for critical function vulnerability, letting unauthenticated remote attackers access sensitive information and bypass protections, exploit requires remote access.
- 7.7 /10 HighCVE-2026-78024 Auth required
Dell Secure Connect Gateway - Server Side Request Forgery
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains a server side request forgery vulnerability caused by improper request validation, letting high privileged remote attackers perform SSRF and unauthorized access.
- 7.1 /10 HighCVE-2026-78023 Auth required
Dell Secure Connect Gateway (SCG) Policy Manager - Authorization Bypass
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an authorization bypass through user-controlled key vulnerability, letting low privileged remote attackers elevate their privileges, exploit requires remote access.
- 7.5 /10 HighCVE-2026-78020 No auth
Dell Secure Connect Gateway - Improper Certificate Validation
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an improper certificate validation vulnerability, letting unauthenticated remote attackers cause denial of service, information disclosure, and remote code execution.
- 7.5 /10 HighCVE-2026-78019 Auth required
Dell Secure Connect Gateway Policy Manager - Privilege Escalation & Remote Code Execution
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an inclusion of functionality from untrusted control sphere vulnerability, letting low privileged remote attackers achieve privilege escalation, filesystem access, and remote code execution, exploit requires remote access with low privileges.
- 7.4 /10 HighCVE-2026-76779 No auth
Dell Secure Connect Gateway - Authentication Bypass
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an improper restriction of excessive authentication attempts vulnerability, letting unauthenticated remote attackers elevate privileges and bypass protection mechanisms.
- 7.5 /10 HighCVE-2026-75352 No auth
OpENer - Denial of Service
OpENer v2.3 contains an integer underflow caused by a flaw in the server-side EtherNet/IP ForwardOpen connection-path parser, letting remote attackers cause denial of service, exploit requires network access.
- 7.5 /10 HighCVE-2026-75351 No auth
OpENer - Denial of Service
OpENer v2.3 contains an out-of-bounds read caused by a flaw in the server-side EtherNet/IP ForwardOpen connection-path parser, letting remote attackers cause denial of service, exploit requires network access.