High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 237 of 568

  • 7.5 /10 High
    CVE-2026-94651 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains a resource management vulnerability caused by improper handling of exceptional conditions in Java bindings, letting attackers cause resource exhaustion, exploit requires no special privileges.

  • 8.2 /10 High
    CVE-2026-94648 No auth

    Apache Thrift - Denial of Service

    Apache Thrift < 0.25.0 contains an allocation of resources without limits or throttling vulnerability in dart bindings, letting attackers cause denial of service by exhausting resources, exploit requires no special privileges.

  • 8.2 /10 High
    CVE-2026-94645 No auth

    Apache Thrift - Denial of Service

    Apache Thrift < 0.25.0 contains an allocation of resources without limits or throttling vulnerability caused by improper validation of specified quantity in Node.js bindings, letting attackers cause resource exhaustion, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-94644 No auth

    Apache Thrift - Denial of Service

    Apache Thrift PHP bindings before 0.25.0 contain an allocation of resources without limits or throttling vulnerability, letting attackers cause denial of service by exhausting resources, exploit requires no special privileges.

  • 8.7 /10 High
    CVE-2026-94642 No auth

    Apache Thrift - Uncaught Exception

    Apache Thrift < 0.25.0 contains an uncaught exception vulnerability in PHP bindings, letting attackers cause unexpected application behavior, exploit requires crafted input triggering the exception.

  • 8.2 /10 High
    CVE-2026-94639 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains an uncaught exception vulnerability caused by improper handling of exceptional conditions and resource allocation without limits in Java bindings, letting attackers cause denial of service, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-94637 No auth

    Apache Thrift - Denial of Service

    Apache Thrift Go bindings before 0.25.0 contain an improper handling of highly compressed data vulnerability caused by data amplification, letting attackers potentially cause denial of service, exploit requires crafted compressed data.

  • 7.8 /10 High
    CVE-2026-94593

    Armatura One - Information Disclosure

    Armatura One contains an information disclosure caused by logging the full database connection command including superuser password in plain text, letting attackers with OS access retrieve credentials, exploit requires OS access.

  • 8.4 /10 High
    CVE-2026-94592

    Armatura One - Authentication Bypass

    Armatura One contains a broken authentication caused by use of a fixed vendor-defined password for the database superuser account, letting attackers with OS access authenticate as superuser, exploit requires OS access and knowledge of the password.

  • 8.4 /10 High
    CVE-2026-94591

    Armatura One - Information Disclosure

    Armatura One contains a cryptographic weakness caused by fixed AES-128-CBC encryption key and IV embedded in the software, letting attackers decrypt stored database and message-broker credentials, exploit requires access to installation package and encrypted config file.

  • 8.8 /10 High
    CVE-2026-94422 No auth

    xdg-dbus-proxy - Remote Code Execution

    xdg-dbus-proxy < 0.1.9 contains a bypass of message filtering caused by improper handling of reply serial numbers on non-reply messages, letting malicious Flatpak apps execute arbitrary code outside their sandbox, exploit requires malicious or compromised Flatpak app.

  • 7.2 /10 High
    CVE-2026-93875 No auth

    JetAppointment WordPress Plugin - Stored XSS

    JetAppointment WordPress plugin <= 2.5.2.1 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'friendlyTime' parameter, letting unauthenticated attackers inject scripts executed in admin browser, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-93756 No auth

    Smash Balloon Social Post Feed - Stored Cross-Site Scripting & Remote Code Execution

    Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin <= 4.13.0 contains a stored XSS caused by insufficient input sanitization and output escaping in Facebook Comment Message via v-html in Admin Builder Preview, letting unauthenticated attackers inject scripts executing on admin feed builder preview, exploit requires attacker to have a Facebook account to post comments.

  • 7.2 /10 High
    CVE-2026-93367 No auth

    Visitors Traffic Real Time Statistics Pro - Stored XSS

    Visitors Traffic Real Time Statistics Pro WordPress plugin <= 11.22 contains a stored XSS caused by unsanitized 'page_title' parameter in ahcpro_track_visitor AJAX action, letting unauthenticated attackers execute arbitrary JavaScript in admin sessions.

  • 8.1 /10 High
    CVE-2026-92820 No auth

    Ninja Forms - File Uploads - Arbitrary File Operations

    Ninja Forms - File Uploads plugin for WordPress <= 3.3.34 contains arbitrary file operations caused by unvalidated attacker-supplied file paths in the external Amazon S3 upload flow, letting unauthenticated attackers read, write, or delete arbitrary files, exploit requires External File Upload action and Email action for read.