High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 273 of 568

  • 8.1 /10 High
    CVE-2026-97687

    urllib3 - Authentication Bypass

    urllib3 1.26.0 to 2.8.0 contains a broken authentication caused by incorrect application of target-server TLS settings to HTTPS proxy connections, letting attackers intercept and modify forwarded traffic, exploit requires use of HTTPS proxy with specific TLS configurations.

  • 8.1 /10 High
    CVE-2026-97395 Auth required

    Apache Polaris - Broken Access Control

    Apache Polaris < 1.8.0 contains a broken access control vulnerability caused by allowing authenticated principals to set FileIO client settings in Iceberg table metadata, letting attackers redirect server-side storage traffic and expose authentication credentials, exploit requires authenticated principal with permission to create or update Iceberg table properties.

  • 7.1 /10 High
    CVE-2026-97024 No auth

    Flatpak - Path Traversal

    Flatpak contains a path traversal vulnerability caused by improper handling of the files/etc directory during app deployment, letting malicious Flatpak apps modify or empty critical host system files, exploit requires malicious app installation or upgrade.

  • 7.2 /10 High
    CVE-2026-96326 No auth

    HT Contact Form – Drag & Drop Form Builder for WordPress - Stored XSS

    HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the Rich Text Editor Field, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires no authentication.

  • 7.4 /10 High
    CVE-2026-96274 No auth

    Baicells Nova 430H - Denial of Service

    Baicells Nova 430H contains a denial of service vulnerability caused by improper validation of malformed NAS payloads in uplink messages during connection setup, letting unauthenticated devices within radio range disrupt service temporarily.

  • 7.1 /10 High
    CVE-2026-95520 No auth

    rpm - Buffer Overflow

    rpm contains a heap-based buffer overflow caused by integer overflow in iterReadArchiveNext() when parsing a symlink entry with RPMTAG_LONGFILESIZES set to 0xFFFFFFFFFFFFFFFF, letting attackers write arbitrary data past buffer, exploit reachable via rpm2cpio, rpm2archive, and rpm -qlvp on untrusted packages.

  • 8.1 /10 High
    CVE-2026-95389 PoC publicNo auth

    Wireshark - Denial of Service

    Wireshark 4.4.0 to 4.4.18 and 4.6.0 to 4.6.8 contains a denial of service caused by a crash in the SCTP protocol dissector, letting remote attackers cause application crash, exploit requires crafted network packets.

  • 8.1 /10 High
    CVE-2026-95387 PoC publicNo auth

    Wireshark - Denial of Service

    Wireshark 4.4.0 to 4.4.18 and 4.6.0 to 4.6.8 contain a denial of service caused by a crash in the SPDY protocol dissector, letting remote attackers cause application crash, exploit requires crafted network traffic.

  • 8.3 /10 High
    CVE-2026-95381

    Google Chrome - Remote Code Execution

    Google Chrome < 154.0.8037.57 contains a remote code execution caused by improper input validation in Printing, letting remote attackers with compromised renderer process execute arbitrary code outside sandbox, exploit requires compromised renderer process.

  • 8.8 /10 High
    CVE-2026-95380 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 154.0.8037.57 contains a type confusion vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires user interaction.

  • 8.0 /10 High
    CVE-2026-95376 PoC publicNo auth

    Google Chrome - Broken Access Control

    Google Chrome < 154.0.8037.57 contains an externally controlled reference vulnerability in DevTools caused by crafted network traffic, letting adjacent attackers bypass system access restrictions via social engineering.

  • 8.8 /10 High
    CVE-2026-95373 PoC publicNo auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free vulnerability in DevTools caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML, exploit requires social engineering.

  • 8.3 /10 High
    CVE-2026-95372 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.57 contains a use after free vulnerability in Chromecast, caused by improper memory handling, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML page.

  • 8.8 /10 High
    CVE-2026-95369 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 154.0.8037.57 contains a remote code execution caused by inappropriate XML implementation in the browser, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires crafted HTML page.

  • 8.8 /10 High
    CVE-2026-95365 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 154.0.8037.57 contains a type confusion vulnerability in IndexedDB, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.