High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 24 of 725

  • 8.8 /10 High
    CVE-2026-119332 No auth

    Ladybird - Use After Free

    Ladybird web browser contains a use-after-free vulnerability caused by improper iterator handling in FinalizationRegistry::cleanup(), letting attackers trigger memory corruption via crafted JavaScript callbacks, exploit requires attacker-controlled JavaScript execution.

  • 7.1 /10 High
    CVE-2026-119331 No auth

    Ladybird - Broken Access Control

    Ladybird web browser contains a broken access control vulnerability caused by missing enforcement of the stylesheet origin-clean flag in CSSStyleSheet methods, letting malicious pages read and modify cross-origin stylesheets, bypassing Same-Origin Policy.

  • 7.5 /10 High
    CVE-2026-119290 No auth

    Zuke - Information Disclosure

    Zuke < 1.51.0 contains an information disclosure vulnerability caused by lack of redaction in reportSummary notes written to GITHUB_STEP_SUMMARY, letting attackers view secret-derived credentials in workflow run summaries, exploit requires GitHub Actions usage with secret-derived text in summary.

  • 7.1 /10 High
    CVE-2026-119289

    Zuke - Broken Access Control

    Zuke prior to 1.10.0 contains a broken access control caused by insufficient verification of dispatched workflow runs in @zuke/gh githubWorkflow(...) gate, letting attackers substitute workflow runs to authorize or block releases, exploit requires external workflow repository granting workflow_dispatch permission to untrusted parties.

  • 7.0 /10 High
    CVE-2026-119288

    Zuke - Command Injection

    Zuke < 1.51.0 contains a command injection caused by improper quoting of Windows .cmd and .bat shim execution, letting attackers execute arbitrary commands in build context with credentials, exploit requires attacker-influenced input containing unquoted metacharacters.

  • 8.0 /10 High
    CVE-2026-119287 Auth required

    Zuke - Command Injection

    Zuke prior to 1.51.0 contains a command injection caused by accepting command-form registry descriptors without proper authorization enforcement, letting remote registry writers execute arbitrary commands with operator privileges, exploit requires use of MCP registry mode with --allow-run.

  • 8.8 /10 High
    CVE-2026-119271 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.79 contains a use after free vulnerability in Skia, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-119270 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.79 contains a remote code execution caused by improper input validation in CacheStorage, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires crafted HTML page.

  • 8.8 /10 High
    CVE-2026-119269 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.79 contains a use after free vulnerability in Blink, caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-119268 No auth

    Google Chrome - Integer Overflow

    Google Chrome < 156.0.8078.79 contains an integer overflow in Editing component caused by improper handling of crafted HTML pages, letting remote attackers execute arbitrary code inside the sandbox, exploit requires crafted HTML page.

  • 8.8 /10 High
    CVE-2026-119267 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.79 contains a memory corruption vulnerability in DOM, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires crafted HTML page.

  • 8.8 /10 High
    CVE-2026-119266 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.79 contains a use after free vulnerability in Quota, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-119265 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.79 contains a memory corruption vulnerability in Quota, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires crafted HTML page.

  • 8.8 /10 High
    CVE-2026-119264 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.79 contains a memory corruption vulnerability in Dawn, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-119262 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.79 contains a remote code execution caused by improper input validation in V8 engine, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires no special privileges.