High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 25 of 552

  • 7.1 /10 High
    CVE-2026-110599 No auth

    L-SMASH - Use After Free

    L-SMASH through 2.14.5 contains a use-after-free vulnerability caused by double free in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c, letting attackers cause heap corruption and crashes by supplying crafted Annex-B streams, exploit requires crafted input stream.

  • 8.6 /10 High
    CVE-2026-110459 No auth

    UniFi Protect AI Key - Broken Access Control

    UniFi Protect AI Key contains an improper access control vulnerability, letting attackers with network access obtain information, make unauthorized changes, and cause denial of service.

  • 8.1 /10 High
    CVE-2026-110455 No auth

    UniFi Protect AI Key - Command Injection

    UniFi Protect AI Key contains a command injection caused by improper input validation, letting attackers with network access execute arbitrary commands on the device, exploit requires specific conditions.

  • 8.0 /10 High
    CVE-2026-110450 No auth

    Nix & Lix - Privilege Escalation

    Nix < 2.35.3 and Lix < 2.95.4 contain a privilege escalation caused by a repair operation that destroys and replaces a store path before content verification, letting attackers escalate privileges, exploit requires ability to trigger repair operation.

  • 7.5 /10 High
    CVE-2026-110449 No auth

    Nix & Lix - Integer Overflow

    Nix < 2.35.3 and Lix < 2.95.4 contain an integer overflow caused by mishandled list allocation when evaluating untrusted expressions, letting attackers cause out-of-bounds write, exploit requires untrusted expressions.

  • 8.8 /10 High
    CVE-2026-110445 No auth

    TeamPlus Messenger - Code Injection

    TeamPlus Messenger contains a code injection vulnerability caused by crafted content interaction, letting unauthenticated remote attackers execute arbitrary JavaScript and code with user privileges, exploit requires user interaction and confirmation of Windows security warning.

  • 8.8 /10 High
    CVE-2026-110444 No auth

    TeamPlus Messenger - Stored XSS & Remote Code Execution

    TeamPlus Messenger contains a stored XSS caused by injection of arbitrary JavaScript via crafted links, letting unauthenticated remote attackers execute code with user privileges after user confirmation.

  • 8.7 /10 High
    CVE-2026-110385 Auth required

    ONLYOFFICE Document Server - Remote Code Execution

    ONLYOFFICE Document Server < 10.0.0 contains a remote code execution caused by improper processing of user-controlled converter XML in Document Builder API, letting authenticated attackers with valid JWT execute arbitrary OS commands as ds service account.

  • 7.8 /10 High
    CVE-2026-110359 Auth required

    Hyland Desktop Host - Privilege Escalation

    Hyland Desktop Host for Windows < 25.1.1 contains a local privilege escalation caused by weak permissions on a privileged service in %PROGRAMDATA%\Hyland\DesktopHost\bin, letting local users escalate privileges.

  • 7.5 /10 High
    CVE-2026-110284 Auth required

    LifterLMS - Local File Inclusion

    LifterLMS WordPress plugin <= 10.3.1 contains a local file inclusion caused by improper handling of shortcode attributes in llms_get_template(), letting authenticated instructors include arbitrary files, exploit requires Instructor-level access.

  • 8.5 /10 High
    CVE-2026-109901 Auth required

    Codepeople CP Multi View Event Calendar - SQL Injection

    Codepeople CP Multi View Event Calendar <= 1.4.41 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-109527 No auth

    Model Context Protocol Python SDK - Denial of Service

    Model Context Protocol Python SDK < 1.29.1 and 2.0.0a1 through 2.0.1 contain a denial of service caused by unbounded buffering of HTTP request bodies in Streamable HTTP session manager and related components, letting unauthenticated remote clients exhaust server memory, exploit requires network access to affected endpoints.

  • 7.1 /10 High
    CVE-2026-108484 No auth

    WPManageNinja Best Payments Plugin for WP - Stored XSS

    WPManageNinja Best Payments Plugin for WP <= 4.6.27 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-108483 No auth

    hippooo Hippoo Mobile App for WooCommerce - Reflected XSS

    hippooo Hippoo Mobile App for WooCommerce <= 1.12.0 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires no special privileges.

  • 8.2 /10 High
    CVE-2026-108480 No auth

    Skydropx Skydropx - Broken Access Control

    Skydropx Skydropx <= 2.1.4 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.