High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 18 of 552
- 7.8 /10 HighCVE-2026-86563 Auth required
DPDK lib/vhost - Memory Corruption
DPDK lib/vhost contains a memory corruption caused by a double-offset bug in vhost log mapping calculation, letting attackers cause incorrect memory access, exploit requires no special conditions.
- 7.8 /10 HighCVE-2026-86562 Auth required
DPDK lib/vhost - Buffer Overflow
DPDK lib/vhost contains a heap buffer overflow caused by a TOCTOU double-fetch of control-queue descriptors in the VDUSE control-queue handler, letting attackers execute arbitrary code, exploit requires crafted control-queue descriptors.
- 8.4 /10 HighCVE-2026-86476 No auth
gst-plugins-base - Buffer Overflow
gst-plugins-base contains a heap buffer overflow caused by improper validation of GstVideoMeta plane strides and offsets during video buffer processing, letting local attackers cause denial of service or code execution via crafted IPC buffers.
- 8.8 /10 HighCVE-2026-86461 Auth required
FV Flowplayer Video Player - Unrestricted File Upload
FV Flowplayer Video Player WordPress plugin <= 7.5.54.7212 contains a limited arbitrary file upload vulnerability caused by incomplete file type validation in check_mimetype, letting authenticated attackers with subscriber access upload executable files, exploit requires 'profile videos on bio' option enabled.
- 7.3 /10 HighCVE-2026-85298 Auth required
Google Cloud Application Integration - Broken Access Control
Google Cloud Application Integration < 2026-08-27 contains an incorrect authorization vulnerability caused by improper AuthConfig validation and integration execution runtime, letting authenticated users escalate privileges and impersonate service accounts, exploit requires user authentication.
- 7.2 /10 HighCVE-2026-84471 Auth required
OpenVPN - Use After Free
OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 contain a use-after-free caused by crafted packets during TLS session promotion or expiry, letting remote authenticated peers cause denial of service or memory leak.
- 7.2 /10 HighCVE-2026-83592 No auth
Contact Form DB for Enfold - Stored XSS
Contact Form DB for Enfold WordPress plugin <= 2.0.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in contact form field values, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.
- 7.9 /10 HighCVE-2026-82715 Auth required
Hitachi Disk Array Driver - Insecure Temporary File
Hitachi Disk Array Driver for AIX < 01-23-/A and Virtual I/O Server < 01-23-/A contain an insecure temporary file vulnerability caused by improper handling of temporary files, letting attackers potentially access or modify temporary files, exploit requires local access.
- 8.8 /10 HighCVE-2026-82026 Auth required
Radar - Broken Access Control
Radar < 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) caused by reliance on runtime-mode check instead of role-based access control, letting authenticated or unauthenticated attackers execute privileged shell commands remotely, exploit requires no special privileges.
- 8.1 /10 HighCVE-2026-79957 Auth required
ServiceNext - Broken Access Control
ServiceNext contains an insecure direct object reference (IDOR) caused by lack of verification that the authenticated token matches the requested user ID in /api/Usuario/GetUsuarios, letting authenticated users access other users' full profiles including cleartext passwords, exploit requires authentication.
- 7.5 /10 HighCVE-2026-78193 No auth
JTL-Connector for WooCommerce - SQL Injection
JTL-Connector for WooCommerce plugin for WordPress <= 2.4.3 contains a time-based SQL injection caused by insufficient escaping of user-supplied parameters in the 'product.push' Identity Endpoint, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-77114 No auth
Document Gallery WordPress plugin - Stored XSS
Document Gallery WordPress plugin <= 5.1.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'dg_thumber_webhook' action request body, letting unauthenticated attackers inject scripts that execute when users access injected pages, exploit requires logging enabled in plugin's Advanced settings.
- 7.5 /10 HighCVE-2026-76655 No auth
HPE NonStop SNMP Trap Multiplexer - Remote Code Execution
HPE NonStop SNMP Trap Multiplexer contains a remote code execution vulnerability, letting remote attackers execute arbitrary code, exploit requires network access.
- 8.2 /10 HighCVE-2026-73798 No auth
HPE NonStop DNS - Denial of Service
HPE NonStop DNS 9.2.3 Non Secure Version contains a denial of service vulnerability caused by unspecified issue, letting attackers cause service disruption, exploit requires no special conditions.
- 7.9 /10 HighCVE-2026-73793 Auth required
HPE NonStop Middleware - Insecure Deserialization & Broken Authentication
HPE NonStop Middleware contains a secret key handling and insecure deserialization vulnerability, letting attackers potentially tamper with data or escalate privileges, exploit requires specific conditions not detailed.