High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 159 of 556

  • 7.5 /10 High
    CVE-2026-75350 No auth

    EIPStackGroup OpENer - Buffer Overflow

    EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow caused by improper handling in GetAttributeList() for EtherNet/IP Get_Attribute_List service, letting remote attackers cause denial of service, exploit requires crafted network request.

  • 7.5 /10 High
    CVE-2026-75349 No auth

    EIPStackGroup OpENer - Denial of Service

    EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains a denial of service caused by out-of-bounds read in Connection Manager request parsing, letting remote attackers cause service disruption, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-75348 No auth

    EIPStackGroup OpENer - Denial of Service

    EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an out-of-bounds read caused by improper validation in the EtherNet/IP TCP SendRRData Common Packet Format parser, letting remote attackers cause denial of service, exploit requires crafted packets.

  • 7.5 /10 High
    CVE-2026-75347 No auth

    EIPStackGroup OpENer - Denial of Service

    EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain a denial of service caused by expired pointer dereference in EtherNet/IP Common Packet Format handling logic, letting remote attackers cause service disruption, exploit requires crafted packets.

  • 7.5 /10 High
    CVE-2026-75346 No auth

    EIPStackGroup OpENer - Out of Bounds Read

    EIPStackGroup OpENer v2.3 and master through commit 76b95cf contain an out-of-bounds read vulnerability in the server-side CIP SetAttributeList service, letting remote attackers cause denial of service, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-75345 No auth

    OpENer - Denial of Service

    OpENer v2.3.0 contains an out-of-bounds read in the unconnected explicit messaging path, letting remote attackers cause denial of service, exploit requires crafted network messages.

  • 8.2 /10 High
    CVE-2026-71884 No auth

    Bouncy Castle - Cryptographic Vulnerability

    Bouncy Castle for Java LTS before 2.73.13 contains a cryptographic vulnerability caused by lack of counter range validation in native one-shot CTR packet cipher, letting attackers recover plaintext from ciphertext due to keystream reuse, exploit requires crafted input with specific IV length.

  • 8.1 /10 High
    CVE-2026-62376

    Vikunja - Authentication Bypass

    Vikunja < 2.4.0 contains an information disclosure vulnerability caused by storing password-reset, email-confirmation, and account-deletion tokens in plaintext in the user_tokens table, letting attackers with read access to the database take over user accounts, exploit requires database read access.

  • 7.5 /10 High
    CVE-2026-62367

    Vikunja - Authentication Bypass

    Vikunja 1.0.0 through 2.3.0 contains an authentication bypass caused by linking SSO login to local accounts using unverified email claims in OpenID Connect provider, letting attackers log in as victims without consent, exploit requires attacker to obtain a valid token with victim's email.

  • 7.1 /10 High
    CVE-2026-62026 No auth

    MIGHTYminnow Dashboard Notes - Cross Site Request Forgery

    MIGHTYminnow Dashboard Notes <= 1.0.3 contains a cross site request forgery vulnerability caused by lack of CSRF protection, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 8.1 /10 High
    CVE-2026-57458 Auth required

    Vikunja - Broken Access Control

    Vikunja 2.3.0 contains a broken access control vulnerability caused by scoped API tokens allowing OAuth authorization code exchange to obtain unrestricted bearer tokens, letting attackers access routes beyond original token scope, exploit requires scoped API token with oauth.authorize permission.

  • 8.8 /10 High
    CVE-2026-55797 Auth required

    Argo CD - Command Injection

    Argo CD 2.11.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contains a command injection caused by unneutralized shell metacharacters in SSH ProxyCommand during Git repository operations, letting users with repository creation/update privileges execute commands on repo-server.

  • 8.1 /10 High
    CVE-2026-39460

    Affected Product - Information Disclosure

    Affected product stores usernames and passwords, including default factory credentials, in plaintext within configuration files accessible via CLI or TFTP export through unauthenticated SNMP, letting attackers with admin or network access disclose sensitive credentials.

  • 8.3 /10 High
    CVE-2026-39453 Auth required

    Switch - Denial of Service

    Switch web server contains a denial of service vulnerability caused by navigating to a specific URL, letting remote attackers cause the device to reboot repeatedly, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-33367 Auth required

    SNMP - Authentication Bypass

    SNMP contains an authentication bypass vulnerability caused by lack of authentication for administrative actions, letting attackers perform configuration retrieval, user modification, and firmware upgrades without authentication.