High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 161 of 556
- 7.1 /10 HighCVE-2026-108108 No auth
PHPNuxBill - Authentication Bypass
PHPNuxBill through 2025.3.20 contains an authentication bypass caused by Password::chap_verify() returning true for incorrect responses in RADIUS CHAP verification, letting attackers with valid usernames gain network access, exploit requires knowledge of a valid username.
- 7.5 /10 HighCVE-2026-108106 No auth
Xerial snappy-java - Denial of Service
Xerial snappy-java < 1.1.10.9 contains an unbounded memory allocation vulnerability caused by large uncompressed length in compressed input, letting attackers exhaust JVM memory causing denial of service, exploit requires crafted compressed input.
- 7.5 /10 HighCVE-2026-108101 Auth required
HortusFox hortusfox-web - Unrestricted File Upload
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel, letting authenticated users upload malicious files for stored cross-site scripting or remote code execution, exploit requires user authentication.
- 7.8 /10 HighCVE-2026-107914 No auth
Backdrop CMS - Broken Access Control
Backdrop CMS 1.34 < 1.34.5 and 1.35 < 1.35.1 contain an information disclosure vulnerability caused by insufficient protection of configuration exports in compressed archives, letting attackers with specific permissions access sensitive configuration data, exploit requires prior export request with proper permissions.
- 7.5 /10 HighCVE-2026-107911 Auth required
FalkorDB - Denial of Service & Memory Corruption
FalkorDB < 4.20.0 contains a type confusion vulnerability caused by improper casting of Redis string objects to Bolt client structures in _read_flags function, letting remote authenticated attackers cause denial of service or memory corruption via GRAPH.QUERY, exploit requires authentication.
- 8.1 /10 HighCVE-2026-107910 No auth
FalkorDB - Authentication Bypass
FalkorDB < 4.20.0 contains an improper authentication vulnerability caused by incorrect handling of Redis AUTH command errors in is_authenticated function, letting remote unauthenticated attackers execute graph queries via the Bolt endpoint, exploit requires Bolt endpoint enabled.
- 7.1 /10 HighCVE-2026-107852 Auth required
Jexactyl - Broken Access Control
Jexactyl < 4.0.5 contains a broken access control vulnerability caused by improper validation of Stripe Checkout Session amount and currency in /api/client/billing/stripe/process, letting authenticated clients pay less or in mismatched currency to process orders.
- 7.5 /10 HighCVE-2026-107840 No auth
Yopass - Denial of Service
Yopass < 14.7.0 contains a denial of service caused by unvalidated use of attacker-controlled HTTP method tokens in Prometheus metrics middleware, letting unauthenticated remote attackers cause memory exhaustion, exploit requires sending arbitrary HTTP methods.
- 7.5 /10 HighCVE-2026-107839 No auth
ageLANServer - Denial of Service
ageLANServer < 1.15.2 contains a denial of service caused by lack of request body size limit in AoE3 POST /game/cloud/getFileURL handler, letting remote unauthenticated clients crash or hang the server, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-107838
RIOT - Denial of Service
RIOT 2023.07 through 2026.07 contains a denial of service caused by ignoring failure from _resp_init() when coap_build_reply() cannot fit a response header, letting remote clients with large extended tokens terminate service, exploit requires nanocoap_token_ext enabled.
- 8.2 /10 HighCVE-2026-107837 No auth
RIOT - Out of Bounds Read
RIOT <= 2026.07 contains an out-of-bounds read caused by insufficient payload validation in _receive() leading to improper sixlowpan_frag_t handling, letting remote attackers cause memory disclosure and network stack crash, exploit requires sending malformed 6LoWPAN fragments.
- 7.1 /10 HighCVE-2026-107836
RIOT - Denial of Service
RIOT <= 2026.07 contains a denial of service caused by improper validation of Block2 response block size in nanocoap_sock_get_slice(), letting malicious CoAP servers crash the client and expose adjacent memory, exploit requires a malicious CoAP server.
- 7.5 /10 HighCVE-2026-107826 No auth
OWASP Coraza WAF - Denial of Service
OWASP Coraza WAF 3.0.0 to 3.8.1 contains a denial of service caused by unbounded recursion in readJSON during JSON validation, letting unauthenticated attackers crash the process via deeply nested JSON payloads.
- 7.2 /10 HighCVE-2026-107823 Auth required
MariaDB Server - Privilege Escalation
MariaDB server 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 contains a privilege escalation caused by unsafe encoding of embedded newline characters in usernames in the view FRM parser, letting attackers with CREATE USER and CREATE VIEW WITH GRANT OPTION escalate database privileges, exploit requires specific user privileges.
- 8.0 /10 HighCVE-2026-107821 PoC public
MariaDB Server - Out of Bounds Read/Write
MariaDB server 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 contains an out-of-bounds read/write vulnerability caused by insufficient validation of FRM metadata when opening binary FRM files, letting attackers with file placement ability crash the server or execute code, exploit requires placing crafted FRM files in data directory.