High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 247 of 568

  • 7.5 /10 High
    CVE-2026-68495 No auth

    FasterXML jackson-dataformats-binary - Denial of Service

    FasterXML jackson-dataformats-binary < 2.16.0 contains a denial of service caused by missing maxNameLength validation in CBOR parser property name decoding, letting attackers submit crafted CBOR documents to exhaust memory, exploit requires ability to submit data to parsing endpoint.

  • 7.4 /10 High
    CVE-2026-67105

    HCL BigFix Service Management - Insecure Communication

    HCL BigFix Service Management contains an insecure communication vulnerability caused by unencrypted HTTP traffic between backend services, letting attackers with internal network access intercept sensitive data and perform man-in-the-middle attacks, exploit requires internal network access.

  • 8.8 /10 High
    CVE-2026-66246 Auth required

    iControl - Broken Access Control

    iControl contains a broken access control vulnerability caused by missing authentication checks or insecure direct object references (IDOR), letting attackers escalate privileges and modify or delete sensitive data, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-63718 No auth

    Apache HTTP Server - HTTP Request/Response Smuggling

    Apache HTTP Server 2.4.30 through 2.4.68 contains an HTTP request/response smuggling vulnerability caused by inconsistent interpretation of HTTP requests in mod_proxy_uwsgi with crafted uwsgi responses, letting remote attackers perform request smuggling.

  • 7.5 /10 High
    CVE-2026-63686 No auth

    Apache HTTP Server - Denial of Service

    Apache HTTP Server < 2.4.69 contains a null pointer dereference caused by improper handling of proxied responses with partially failing charset conversion in mod_xml2enc, letting untrusted backend servers cause denial of service.

  • 7.5 /10 High
    CVE-2026-63292 PoC publicNo auth

    Apache HTTP Server - Buffer Overflow

    Apache HTTP Server through 2.4.68 contains a stack-based buffer overflow caused by an HTTP Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised, letting remote clients cause denial of service or execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-63045

    Apache HTTP Server - Open Proxy

    Apache Software Foundation Apache HTTP Server <= 2.4.68 contains an open proxy vulnerability caused by improper validation of FTP PASV reply address in mod_proxy_ftp, letting untrusted FTP servers cause the proxy to connect to arbitrary third-party hosts, exploit requires forward proxy configuration.

  • 7.5 /10 High
    CVE-2026-62073 No auth

    WP Full Stripe Free - Broken Access Control

    WP Full Stripe Free <= 8.5.6 contains a broken access control vulnerability caused by improper authorization checks, letting unauthenticated attackers access restricted functionality, exploit requires no authentication.

  • 7.6 /10 High
    CVE-2026-62060 Auth required

    captivateaudio Captivate Sync - SQL Injection

    captivateaudio Captivate Sync <= 3.3.2 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.6 /10 High
    CVE-2026-62059 PoC publicAuth required

    Ultimate Member Ultimate Member - SQL Injection

    Ultimate Member Ultimate Member <= 2.13.1 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-59685 No auth

    Apache HTTP Server - Out of Bounds Write

    Apache HTTP Server 2.4.0 through 2.4.68 contains an out-of-bounds write caused by processing paths with 8.3 names on Windows, letting attackers cause memory corruption, exploit requires crafted path input.

  • 7.5 /10 High
    CVE-2026-56661 Auth required

    GetSimple CMS CE - Server Side Request Forgery

    GetSimple CMS CE < 1.5 contains a server-side request forgery caused by insufficient validation of user-supplied URLs in the update handler, letting attackers retrieve internal service responses, exploit requires form submission.

  • 7.2 /10 High
    CVE-2026-56589 No auth

    HCL BigFix Service Management - Stored XSS

    HCL BigFix Service Management contains a stored XSS caused by improper sanitization of user input, letting attackers inject malicious scripts that execute when victims view affected pages, enabling session hijacking.

  • 7.5 /10 High
    CVE-2026-56449 No auth

    Apache HTTP Server - Out of Bounds Write

    Apache HTTP Server 2.4.0 through 2.4.68 contains an out-of-bounds write caused by crafted HTTP response bodies in mod_proxy_html, letting remote attackers corrupt memory, exploit requires crafted HTTP response.

  • 7.5 /10 High
    CVE-2026-56153 No auth

    Apache HTTP Server - Out of Bounds Write

    Apache HTTP Server 2.4.0 through 2.4.68 contains an out-of-bounds write caused by improper memory handling in mod_charset_lite, letting attackers potentially corrupt memory, exploit requires crafted requests.