High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 179 of 556

  • 8.8 /10 High
    CVE-2026-76453

    Cisco NX-OS - Improper Neutralization

    Cisco NX-OS contains improper neutralization vulnerabilities (CWE-707) discovered internally, letting attackers potentially exploit these issues, exploit requires unspecified conditions.

  • 7.6 /10 High
    CVE-2026-76283

    CVE-2026-76283

    Protection Mechanism Failure. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.

  • 8.8 /10 High
    CVE-2026-76282

    CVE-2026-76282

    Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.

  • 7.7 /10 High
    CVE-2026-76266 Auth required

    Splunk Enterprise - Command Injection & Privilege Escalation

    Splunk Enterprise < 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux contains a command injection caused by trusting existing installation content during package upgrade, letting local users escalate privileges to root, exploit requires package upgrade after local modification.

  • 8.1 /10 High
    CVE-2026-62251 Auth required

    Homer - SQL Injection

    Homer < 11.0.283 contains a SQL injection caused by unsanitized user-supplied 'rawquery' passed directly to DuckDB in V4StatisticsQuery handler, letting authenticated users execute arbitrary SQL, exploit requires authentication.

  • 8.1 /10 High
    CVE-2026-59347 No auth

    VMware Workstation and Fusion - Remote Code Execution

    VMware Workstation and Fusion 25H2, 26H1 contain a buffer overflow caused by a flaw in HGFS, letting local attackers with admin privileges on a VM execute code as the VMX process on the host, exploit requires local admin on VM.

  • 8.3 /10 High
    CVE-2026-58069 Auth required

    Veeam Backup & Replication - Broken Access Control

    Veeam Backup & Replication contains a file read vulnerability caused by improper access control, letting authenticated Cloud Connect tenants read arbitrary files on the service provider host, exploit requires tenant authentication.

  • 7.1 /10 High
    CVE-2026-5703 Auth required

    Satel Iberia SenNet Datalogger Serie 200 - Path Traversal

    Satel Iberia SenNet Datalogger Serie 200 contains a path traversal caused by URL manipulation in the web portal, letting authenticated users read arbitrary files or list directories accessible to the web server user.

  • 7.5 /10 High
    CVE-2026-56851 No auth

    Nickname profile - Denial of Service

    Nickname profile contains a buffer overflow caused by transforming crafted input into a short destination buffer, letting attackers cause application panic via out-of-bounds slice error, exploit requires crafted input.

  • 7.4 /10 High
    CVE-2026-46572 No auth

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_ib_cut_tail() in libntfs-3g/index.c, letting attackers corrupt heap memory via crafted NTFS images, exploit requires crafted directory.

  • 8.1 /10 High
    CVE-2026-46570 No auth

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_index_walk_down() in libntfs-3g/index.c, letting attackers corrupt heap memory via crafted NTFS image, exploit requires crafted file metadata.

  • 7.7 /10 High
    CVE-2026-46569 No auth

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_ib_copy_tail() in libntfs-3g/index.c, letting attackers corrupt heap memory via crafted NTFS images, exploit requires creating or extending a directory.

  • 7.1 /10 High
    CVE-2026-46434 Auth required

    wger - Broken Access Control

    wger < 2.6 contains a broken access control vulnerability caused by improper privilege checks in UserDeactivateView, letting gym_trainer users deactivate higher-privileged accounts, exploit requires gym_trainer permission.

  • 7.1 /10 High
    CVE-2026-43976 Auth required

    wger - Broken Access Control

    wger < 2.6 contains a broken access control caused by flawed gym-scope guard allowing trainers with specific permissions and no gym assignment to read private data of unaffiliated users, exploit requires trainer permissions and no gym assignment.

  • 7.6 /10 High
    CVE-2026-42721 Auth required

    SERVIT Software Solutions affiliate-toolkit - SQL Injection

    SERVIT Software Solutions affiliate-toolkit <= 3.9.1 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.