High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 268 of 568

  • 7.5 /10 High
    CVE-2026-102996 No auth

    pypdf - Denial of Service

    pypdf < 6.18.1 contains a memory exhaustion vulnerability caused by processing an unusually large /Widths array in TrueType or Type1 simple fonts, letting attackers cause excessive memory consumption during text extraction, exploit requires crafted PDF.

  • 7.5 /10 High
    CVE-2026-102995 No auth

    pypdf - Denial of Service

    pypdf < 6.18.1 contains a resource consumption vulnerability caused by parsing oversized /ToUnicode mapping tokens in font objects, letting attackers cause excessive memory use during text extraction, exploit requires crafted PDF.

  • 7.5 /10 High
    CVE-2026-102994 No auth

    pypdf - Denial of Service

    pypdf < 6.18.0 contains a denial of service caused by crafted PDFs with long indirect-object identifiers or generation-number tokens without whitespace, letting attackers cause long runtimes and application unavailability, exploit requires crafted PDF input.

  • 7.5 /10 High
    CVE-2026-102993 No auth

    pypdf - Denial of Service

    pypdf < 6.17.0 contains a denial of service caused by excessively large Roman page-label values in _page_labels.py, letting attackers consume large memory and potentially make the application unavailable, exploit requires crafted PDF.

  • 7.3 /10 High
    CVE-2026-102913 No auth

    SourceCodester Car Driving School Management System - SQL Injection

    SourceCodester Car Driving School Management System 1.0 contains a SQL injection caused by manipulation in /classes/Master.php?f=save_enrollment, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-102910 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "test_id" argument in /reviewer_0/admins/assessments/examproper/exam-delete.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-102909 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "access_code" argument in /reviewer_0/admins/assessments/examproper/btn_functions.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-102908 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "ID" argument in /reviewer_0/admins/assessments/examproper/questions-view.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-102874 No auth

    HKUDS AnyTool - Command Injection

    HKUDS AnyTool 0.1.0 contains a command injection caused by manipulation of the command/shell argument in subprocess.run in Execute Endpoint, letting remote attackers execute arbitrary OS commands, exploit requires remote access.

  • 7.5 /10 High
    CVE-2026-102717 No auth

    MQTT WebSocket - Information Disclosure & Denial of Service

    MQTT WebSocket contains a memory disclosure or crash vulnerability caused by setter ABI mismatch, letting attackers cause denial of service or information disclosure, exploit requires crafted WebSocket messages.

  • 7.8 /10 High
    CVE-2026-102490 CISA KEVAuth required

    Zammad - Privilege Escalation

    Zammad all versions contain a privilege escalation vulnerability that allows the local zammad user to escalate privileges to root, exploit requires local access as zammad user.

  • 7.2 /10 High
    CVE-2026-102454 Auth required

    Digiwin EasyFlow .NET - Arbitrary File Upload

    Digiwin EasyFlow .NET contains an arbitrary file upload vulnerability allowing privileged remote attackers to upload and execute web shell backdoors, enabling arbitrary code execution on the server, exploit requires privileged remote access.

  • 7.1 /10 High
    CVE-2026-102398 No auth

    Supsystic Popup - Reflected XSS

    Supsystic Popup <= 1.13.1 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-102396 No auth

    Ultimate Maps by Supsystic - Reflected XSS

    Ultimate Maps by Supsystic <= 1.5.5 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-102395 No auth

    Easy Google Maps - Reflected XSS

    Easy Google Maps <= 1.14.6 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.