High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 178 of 556
- 8.8 /10 HighCVE-2026-83742 Auth required
wolfSSL wolfSSH - Integer Overflow
wolfSSL wolfSSH v1.4.11 through v1.5.0 on non-Windows platforms contains an unsigned integer underflow in wstrncat() in src/port.c, letting authenticated remote attackers write one out-of-bounds null byte past a stack buffer by sending crafted SFTP paths, exploit requires authentication.
- 8.8 /10 HighCVE-2026-83540 Auth required
wolfSSH - Broken Access Control
wolfSSH Windows port 1.4.15 through 1.5.0 contains a broken access control caused by improper release of Windows logon tokens between connections, letting less privileged users escalate privileges by login poisoning, exploit requires valid user account.
- 7.5 /10 HighCVE-2026-82212 No auth
Nexi XPay Build WordPress - Broken Access Control
Nexi XPay Build WordPress plugin through 7.6.2 contains a broken access control caused by improper validation of security tokens on payment notification route, letting unauthenticated attackers mark orders as paid or failed, exploit requires no authentication.
- 8.2 /10 HighCVE-2026-82211 No auth
Nexi XPay Build WordPress - Broken Access Control
Nexi XPay Build WordPress plugin through 7.6.2 contains a broken access control vulnerability caused by lack of verification of payment results in unauthenticated routes, letting attackers mark orders as paid or failed, cancel orders, and obtain order keys exposing guest buyer details, exploit requires no authentication.
- 8.2 /10 HighCVE-2026-77214 No auth
libexpat - Out of Bounds Read
libexpat before commit 13c5f63 contains a heap buffer over-read caused by improper validation of caller-supplied length in XML_ParseBuffer, letting attackers read out-of-bounds heap memory, exploit requires prior buffer allocation.
- 8.8 /10 HighCVE-2026-76484
Cisco License On-Prem - Code Injection
Cisco License On-Prem contains a code injection vulnerability caused by insufficient protection against code injection, letting attackers execute arbitrary code, exploit requires unspecified conditions.
- 8.8 /10 HighCVE-2026-76472
CVE-2026-76472
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-76472 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.
- 8.8 /10 HighCVE-2026-76470
CVE-2026-76470
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76470 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-682.
- 7.4 /10 HighCVE-2026-76469
CVE-2026-76469
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76469 are related to insufficient control flow management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-691.
- 8.2 /10 HighCVE-2026-76468
CVE-2026-76468
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76468 are related to improper input validation that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.
- 7.5 /10 HighCVE-2026-76467
Cisco Networking - Resource Management Vulnerability
Cisco networking products contain an improper control of resource through its lifetime vulnerability (CWE-664), letting attackers potentially cause resource mismanagement, exploit requires unspecified conditions.
- 8.8 /10 HighCVE-2026-76463 No auth
Cisco Networking - Broken Access Control
Cisco networking products contain improper access control vulnerabilities caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires network access.
- 8.6 /10 HighCVE-2026-76458 No auth
Cisco NX-OS - Denial of Service
Cisco NX-OS contains improper handling of exceptional conditions (CWE-703) causing multiple vulnerabilities, letting attackers potentially cause denial of service or other impacts, exploit requires network access.
- 8.6 /10 HighCVE-2026-76457 No auth
Cisco NX-OS - Out-of-Bounds Read
Cisco NX-OS contains out-of-bounds read vulnerabilities (CWE-125) caused by improper bounds checking, letting attackers potentially read unauthorized memory, exploit requires network access.
- 8.6 /10 HighCVE-2026-76456 No auth
Cisco NX-OS - Input Validation
Cisco NX-OS contains an input validation vulnerability caused by improper validation of special elements in command processing, letting attackers potentially execute unintended commands or cause denial of service, exploit requires crafted command input.