High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 164 of 556

  • 7.5 /10 High
    CVE-2026-97031 No auth

    Server Process - Denial of Service

    A server process contains a memory exhaustion vulnerability caused by allowing multiple ECH outer extension references, letting remote attackers cause denial of service, exploit requires sending crafted packets.

  • 7.5 /10 High
    CVE-2026-95209 No auth

    gnutls - Denial of Service

    gnutls v3.8.13 contains a denial of service caused by rejection of legitimate CA certificates, letting attackers cause service disruption, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-95208

    wolfSSL - Denial of Service

    wolfSSL v5.9.1 and v5.9.2 contain a denial of service caused by improper handling in ConfirmNameConstraints() function when processing crafted Certificate Authority certificates, letting attackers cause valid certificates without SAN to be rejected, exploit requires crafted CA certificates.

  • 7.5 /10 High
    CVE-2026-95184 No auth

    GnuTLS - Denial of Service

    GnuTLS v3.8.13 contains improper certificate validation causing rejection of legitimate certificates, letting attackers cause denial of service by blocking valid users, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-95116 No auth

    libming - Denial of Service

    libming <= 0.4.8 contains a denial of service caused by improper handling in readtag_file() in src/blocks/fromswf.c, letting remote attackers cause application crash, exploit requires crafted SWF file.

  • 8.8 /10 High
    CVE-2026-94585 No auth

    Brocade Fabric OS - Authentication Bypass

    Brocade Fabric OS < 9.2.2d on MXG610 contains an authentication bypass caused by an unauthenticated endpoint in the Single Sign-On workflow, letting unauthenticated network-adjacent attackers gain administrative access.

  • 7.8 /10 High
    CVE-2026-94582

    Brocade Fabric OS - Buffer Overflow

    Brocade Fabric OS < 10.0.1 contains a buffer overflow caused by improper bounds checking in internal diagnostic and route validation routines of the FSPF protocol, letting attackers cause daemon crash or execute code, exploit requires chaining other vulnerabilities.

  • 8.0 /10 High
    CVE-2026-94579 Auth required

    Brocade Fabric OS - Command Injection

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an OS command injection caused by improper handling of shell metacharacters in usernames or profile identifiers during SSH session termination, letting authenticated users execute arbitrary commands with root privileges, exploit requires authentication via external directory or AAA service.

  • 8.8 /10 High
    CVE-2026-94578 Auth required

    Brocade Fabric OS - Broken Access Control

    Brocade Fabric OS < 10.0.1 contains a broken access control vulnerability caused by improper authorization logic in the AAA integration framework, letting remote authenticated users gain root-equivalent chassis access by crafted VSAs or directory claims.

  • 7.8 /10 High
    CVE-2026-94577 Auth required

    Brocade Fabric OS - Privilege Escalation

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contains a privilege escalation caused by improper CLI authorization handling, letting authenticated users bypass RBAC and elevate privileges to root, exploit requires authenticated user or local process.

  • 8.0 /10 High
    CVE-2026-94576 Auth required

    Brocade Fabric OS - Authentication Bypass & Privilege Escalation

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an authentication bypass and privilege escalation caused by flawed authorization checks in the account management interface, letting authenticated users escalate privileges by modifying other accounts, exploit requires authenticated user access.

  • 7.5 /10 High
    CVE-2026-94440 No auth

    Multipart Form Parser - Denial of Service

    A multipart form parser contains a memory limit bypass caused by improper handling of remaining limit at the start of a part, letting attackers read arbitrarily long lines into memory, exploit requires crafted multipart requests.

  • 7.5 /10 High
    CVE-2026-94439 No auth

    HTTP Server - HTTP Request Smuggling

    An HTTP server improperly continues to read and serve HTTP requests after sending a 2xx response to an HTTP/1 CONNECT request without hijacking the connection, causing request smuggling due to tunnel misinterpretation.

  • 7.1 /10 High
    CVE-2026-93860 Auth required

    OpenStack Mistral - Broken Access Control

    OpenStack Mistral through 23.0.0 contains a broken access control caused by lack of policy enforcement in /v2/maintenance API controller, letting any valid token holder read and change cluster-wide maintenance state, exploit requires valid Mistral token.

  • 8.7 /10 High
    CVE-2026-93858 Auth required

    OpenStack Mistral - Command Injection

    OpenStack Mistral through 23.0.0 contains a command injection caused by passing user-supplied proxy_command to paramiko.ProxyCommand, letting authenticated project members execute arbitrary local commands, exploit requires authentication.