High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 188 of 556

  • 7.1 /10 High
    CVE-2026-94675 No auth

    Fluent Forms Pro Add On Pack - Reflected XSS

    Fluent Forms Pro Add On Pack <= 6.2.13 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 8.1 /10 High
    CVE-2026-89430 Auth required

    Gitea - Broken Access Control

    Gitea contains a broken access control vulnerability caused by insufficient validation of push mirror remote addresses during synchronization, letting repository administrators force-push to internal or blocked Git services, exploit requires admin access to repository.

  • 7.1 /10 High
    CVE-2026-86684 PoC publicAuth required

    Gitea - Broken Access Control

    Gitea contains a broken access control vulnerability caused by improper permission checks in the push mirror API allowing repository administrators to push to local file system paths if the repository owner has permission, exploit requires repository administrator privileges.

  • 8.2 /10 High
    CVE-2026-86362 Auth required

    Dell System Update - Elevation of Privileges

    Dell System Update < 2.3.0.0 contains an improper access control vulnerability caused by flawed access restrictions, letting low privileged local attackers escalate privileges, exploit requires local access.

  • 8.2 /10 High
    CVE-2026-86361 Auth required

    Dell System Update - Privilege Escalation

    Dell System Update < 2.3.0.0 contains an incorrect permission assignment for critical resource, letting low privileged local attackers escalate privileges, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-85523 Auth required

    Felisify Information Technologies Industry and Trade Inc. SambaBox - OS Command Injection

    Felisify Information Technologies Industry and Trade Inc. SambaBox < 5.4.1 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary commands remotely, exploit requires crafted input.

  • 7.0 /10 High
    CVE-2026-84854 Auth required

    WibuKey - Buffer Overflow

    WibuKey driver for Windows < 6.72 contains a buffer overflow caused by insufficient validation of user input when calculating kernel buffer size, letting attackers cause system crash or modify adjacent kernel memory, exploit requires local access.

  • 7.1 /10 High
    CVE-2026-83550

    postgres-exporter - Information Disclosure & Denial of Service

    postgres-exporter contains an information disclosure and denial of service vulnerability caused by exposed debug endpoints via blank import of net/http/pprof on unauthenticated metrics listener, letting remote attackers within cluster network access sensitive data and cause service disruption, exploit requires network access within cluster.

  • 7.5 /10 High
    CVE-2026-82988 No auth

    ViewSonic ViewBoard - Arbitrary File Download

    ViewSonic ViewBoard contains an arbitrary file download vulnerability in the vCast APK delivery mechanism, letting remote unauthenticated attackers trigger unprivileged APK installation via a malicious APK URL.

  • 8.1 /10 High
    CVE-2026-82531 PoC publicNo auth

    Smarty - Code Injection

    Smarty < 4.5.8 and 5.x < 5.8.5 contain a code injection vulnerability caused by improper restoration of top-level nocache_hash during multi-component template inheritance, letting attackers execute arbitrary PHP code remotely, exploit requires crafted assigned data with forged SmartyNocache marker.

  • 7.4 /10 High
    CVE-2026-82162 No auth

    Dell Command | Configure - Elevation of Privileges

    Dell Command | Configure (DCC) < 5.2.3.35 contains an improper handling of mixed encoding vulnerability, letting unauthenticated remote attackers elevate privileges, exploit requires remote access.

  • 7.1 /10 High
    CVE-2026-79960 Auth required

    Gitea - Broken Access Control

    Gitea contains a broken access control vulnerability caused by incorrect attribution of repository owner when using deploy keys, letting attackers with writable deploy keys create protected tags and change repository visibility, exploit requires writable deploy key.

  • 7.2 /10 High
    CVE-2026-79811 Auth required

    ClearPass Policy Manager - SQL Injection

    ClearPass Policy Manager contains a sql injection caused by improper input sanitization in the API, letting remote authenticated attackers with admin privileges execute arbitrary database commands.

  • 7.2 /10 High
    CVE-2026-79810 Auth required

    HPE Networking ClearPass Policy Manager - Remote Code Execution

    HPE Networking ClearPass Policy Manager contains a remote code execution caused by vulnerabilities in the affected interface, letting authenticated remote attackers with high privileges execute arbitrary code on the operating system.

  • 7.3 /10 High
    CVE-2026-79809 No auth

    ClearPass Policy Manager - Path Traversal

    ClearPass Policy Manager contains an unauthenticated path traversal vulnerability in an API endpoint, letting remote attackers influence authorization decisions and gain unintended roles, exploit requires no authentication.