High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 222 of 568

  • 7.2 /10 High
    CVE-2026-88396 Auth required

    ApiAdmin - Remote Code Execution

    ApiAdmin <= 5.0 contains a directory traversal and unrestricted file upload vulnerability caused by lack of file extension validation in the admin file-upload endpoint, letting logged-in admin users execute remote code via uploaded PHP files.

  • 7.5 /10 High
    CVE-2026-88394 No auth

    WookTeam - Path Traversal

    WookTeam <= 1.6.6 contains a path traversal caused by lack of path normalization in /api/project/task/export endpoint, letting remote attackers download arbitrary files readable by the web server, exploit requires crafted JSON payload.

  • 7.5 /10 High
    CVE-2026-88392 No auth

    Unimall - Directory Traversal

    Unimall v4 contains a directory traversal caused by improper validation in FileUploadController.local(), letting attackers execute arbitrary code remotely, exploit requires crafted file upload.

  • 8.4 /10 High
    CVE-2026-86671 Auth required

    Eclipse Che - Server Side Request Forgery

    Eclipse Che >= 7.29.0 contains a server-side request forgery caused by lack of scheme and host allow-list in URLFetcher.fetch(), letting authenticated users read local files, access internal services, and exfiltrate SCM tokens via crafted URLs or malicious devfiles.

  • 7.7 /10 High
    CVE-2026-78861

    Mercusys AC12 - Remote Code Execution

    Mercusys AC12 V2 contains a remote code execution caused by a hardcoded 512-bit RSA Private Key, letting local attackers execute arbitrary code, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-78860 Auth required

    Mercusys AC12 V2 - Remote Code Execution

    Mercusys AC12 V2 contains a local code execution vulnerability caused by storage of information in plaintext, letting local attackers execute arbitrary code, exploit requires local access.

  • 7.9 /10 High
    CVE-2026-77805 Auth required

    In Progress Telerik Fiddler Classic - Privilege Escalation

    In Progress Telerik Fiddler Classic for Windows < 6.0.20262.10021 contains a privilege escalation caused by insufficient integrity checks on external helper tools, letting local low-privilege attackers execute unintended code with elevated privileges, exploit requires user to launch the tool and approve elevation prompt.

  • 8.1 /10 High
    CVE-2026-77226 No auth

    Camunda - Broken Access Control

    Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability caused by improper admin group membership checks in the Admin web application's first-run setup endpoint, letting unauthenticated remote attackers create admin accounts, exploit requires camunda-admin group to be empty while system is administered.

  • 8.5 /10 High
    CVE-2026-63277 PoC publicNo auth

    LibreOffice Calc - Remote Code Execution

    LibreOffice Calc contains a remote code execution vulnerability caused by loading a Java database driver from a remote location via external data source links, letting attackers execute Java code remotely, exploit requires opening a crafted document.

  • 7.0 /10 High
    CVE-2026-58880 Auth required

    Bluetooth Stack - Race Condition

    Bluetooth stack in handle_app_val_response of btif_rc.cc contains a race condition leading to code execution, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.5 /10 High
    CVE-2026-58865 No auth

    PduParser - Denial of Service

    PduParser contains a persistent denial of service caused by missing bounds checks in multiple functions, letting remote attackers cause denial of service without requiring user interaction.

  • 7.8 /10 High
    CVE-2026-58859 Auth required

    Unknown - Denial of Service & Privilege Escalation

    Unknown product contains a denial of service caused by uncaught exceptions in multiple places, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-58854 Auth required

    Generic Software - Privilege Escalation

    Affected software contains a type confusion vulnerability causing memory corruption, letting local attackers escalate privileges without needing additional execution rights or user interaction.

  • 7.8 /10 High
    CVE-2026-58841 Auth required

    VirtualAudioControllerTest - Broken Access Control

    VirtualAudioControllerTest.java contains a permission bypass caused by a logic error in multiple functions, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-58835 Auth required

    btif_storage.cc - Remote Code Execution

    btif_storage.cc contains an out-of-bounds write caused by a heap buffer overflow in cfg2prop, letting remote attackers execute arbitrary code without additional privileges, exploit requires no user interaction.