High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 180 of 556

  • 7.6 /10 High
    CVE-2026-42720 Auth required

    Sarah Giles Dynamic User Directory - SQL Injection

    Sarah Giles Dynamic User Directory <= 2.4 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.6 /10 High
    CVE-2026-42714 Auth required

    Piggly Dev Pix por Piggly (para Woocommerce) - SQL Injection

    Piggly Dev Pix por Piggly (para Woocommerce) <= 2.1.2 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.

  • 7.6 /10 High
    CVE-2026-42713 Auth required

    Gopiplus Post title marquee scroll - SQL Injection

    Gopiplus Post title marquee scroll <= 9.9 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.

  • 7.6 /10 High
    CVE-2026-42710 Auth required

    10Web Slider - SQL Injection

    10Web Slider by 10Web <= 1.2.63 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.6 /10 High
    CVE-2026-42708 Auth required

    AF themes WP Post Author - SQL Injection

    AF themes WP Post Author <= 4.0.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-42618 Auth required

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_decompress() in compress.c, letting attackers corrupt heap memory by reading a specially crafted NTFS image, exploit requires crafted file access.

  • 7.1 /10 High
    CVE-2026-42617 Auth required

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_ir_to_ib() in index.c, letting attackers corrupt heap memory via crafted NTFS images, exploit requires file creation in a directory.

  • 7.8 /10 High
    CVE-2026-42616 No auth

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in cat() function in ntfscat.c, letting attackers corrupt heap memory by reading a crafted malicious NTFS image, exploit requires crafted NTFS image.

  • 8.5 /10 High
    CVE-2026-34499

    Johnson Controls ADVMS - Hardcoded Credentials

    Johnson Controls ADVMS < 3.10 contains a hardcoded cryptographic key vulnerability caused by embedded keys in the executable, letting attackers read sensitive constants within the executable, exploit requires access to the executable.

  • 7.2 /10 High
    CVE-2026-20362 No auth

    Cisco Finesse - Server-Side Request Forgery

    Cisco Finesse contains a server-side request forgery caused by improper input validation in the web-based management interface, letting unauthenticated remote attackers obtain limited sensitive information, exploit requires crafted HTTP request.

  • 7.7 /10 High
    CVE-2026-19396

    ASUS RT-BE57 Router - Authentication Bypass

    ASUS RT-BE57 router contains a predictable seed vulnerability in the PRNG used for IFTTT pairing token generation, letting unauthenticated nearby attackers derive tokens to read or modify router settings, exploit requires proximity to observe pairing session.

  • 8.1 /10 High
    CVE-2026-19186

    Zephyr IEEE802154 - Out-of-Bounds Read & Write

    Zephyr subsys/net/l2/ieee802154 contains an out-of-bounds read and write caused by improper length validation in ieee802154_decipher_data_frame(), letting remote attackers cause memory corruption and denial of service by sending crafted short frames, exploit requires enabled CONFIG_NET_L2_IEEE802154_SECURITY with crypto device and active security session.

  • 8.4 /10 High
    CVE-2026-16528 Auth required

    ASUS Router - Authentication Bypass

    ASUS routers contain an insertion of sensitive information into log files caused by improper logging of DDNS credentials, letting remote authenticated attackers obtain credentials and potentially modify DNS settings, exploit requires authentication.

  • 7.4 /10 High
    CVE-2026-16516

    wolfSSH - Man-in-the-Middle

    wolfSSH contains a man-in-the-middle vulnerability caused by improper validation of ECDSA curve identifiers in KEXDH_REPLY host key blobs, letting active network attackers bypass signature verification, exploit requires active MitM and lax public key checks.

  • 8.8 /10 High
    CVE-2026-15894 No auth

    Zephyr Bluetooth Mesh - Buffer Overflow

    Zephyr Bluetooth Mesh On-Demand Private Proxy (CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled) contains a buffer overflow caused by copying an oversized Solicitation PDU into a fixed 17-byte stack buffer without length bounds, letting remote attackers send crafted unauthenticated advertisements to cause stack overwrite, exploit requires attacker to be in radio range.