High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 276 of 568
- 8.8 /10 HighCVE-2026-94954 Auth required
TOTOLINK N150RT - Buffer Overflow
TOTOLINK N150RT firmware V3.4.0-B20201030 contains a buffer overflow caused by improper handling of the url request parameter in /boafrm/formFilter during addFilterUrl or addFilterUrlFlag actions, letting remote attackers execute code, exploit requires crafted URL request.
- 8.8 /10 HighCVE-2026-94953 Auth required
TOTOLINK N150RT - Buffer Overflow
TOTOLINK N150RT firmware V3.4.0-B20201030 contains a buffer overflow caused by improper handling of the ApCliWEPKey field in /boafrm/formAjaxSet route, letting remote attackers cause memory corruption, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-94204 No auth
Dashcam Platform - Information Disclosure
Dashcam platform central cloud storage backend contains a misconfiguration caused by public-read permissions, letting attackers access sensitive user records, live footage, application packages, and firmware files without restrictions, exploit requires no special privileges.
- 7.0 /10 HighCVE-2026-92371 Auth required
TeamViewer - Race Condition
TeamViewer Full Client and Host for Linux < 15.82 contains a race condition vulnerability in Cloud Session Recording path validation, letting local authenticated attackers perform privileged file operations in unintended locations.
- 8.8 /10 HighCVE-2026-92370 No auth
TeamViewer - Broken Access Control
TeamViewer Full Client, Host, and related modules on Windows, Linux, and macOS contain an improper access control vulnerability caused by modification of access control parameters during session establishment, letting authenticated remote attackers bypass user-configured permissions and perform unauthorized actions, potentially leading to remote code execution.
- 7.3 /10 HighCVE-2026-92369 Auth required
TeamViewer - Privilege Escalation
TeamViewer Full Client and Host prior to 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism, letting local low-privileged attackers escalate privileges to NT AUTHORITY/SYSTEM by replacing rollback backup files during installation rollback.
- 7.8 /10 HighCVE-2026-92368 No auth
TeamViewer - Remote Code Execution
TeamViewer Full Client and Host for Linux and macOS < 15.82 contain a heap-based buffer overflow caused by size mismatch during decompression of .tvs session recording files, letting attackers achieve arbitrary code execution with user privileges, exploit requires user to open a crafted session recording.
- 7.5 /10 HighCVE-2026-92227 No auth
Joomla! Core - Authentication Bypass
Joomla! Core 4.0.0-5.4.8, 6.0.0-6.1.3 contains an authentication bypass caused by premature issuance of rememberme cookies, letting attackers bypass MFA, exploit requires crafted rememberme cookie.
- 8.0 /10 HighCVE-2026-92222 Auth required
Joomla! Core - Server Side Request Forgery
Joomla! Core 4.0.0-5.4.8, 6.0.0-6.1.3 contains a server side request forgery caused by improper validation of URLs used for server-side requests, letting attackers perform SSRF attacks, exploit requires crafted URL input.
- 8.8 /10 HighCVE-2026-92142 Auth required
Apache Karaf - Remote Code Execution
Apache Karaf < 4.4.12 and < 4.5.0 contains a remote code execution caused by missing RBAC checks on MBean lifecycle operations in JMX MBeanServer, letting authenticated users with viewer role execute arbitrary code remotely, exploit requires JMX authentication with any role.
- 7.5 /10 HighCVE-2026-91191
Device Update Mechanism - Authentication Bypass
A device's update mechanism contains a broken authentication caused by disabled signature verification and exposed production private key in the SDK, letting attackers supply malicious packages that execute arbitrary code with root privileges during installation, exploit requires ability to supply packages.
- 8.3 /10 HighCVE-2026-90906 Auth required
Joomla! Core - Stored XSS
Joomla! Core 1.5.0-5.4.8, 6.0.0-6.1.3 contains a stored XSS caused by lack of escaping in HTMLHelper::link method, letting attackers execute scripts via crafted links, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-87748 Auth required
Interprobe Information Technologies Inc. Qorela DC - Broken Access Control
Interprobe Information Technologies Inc. Qorela DC >= 1.6.1-RC29 < 1.6.2 contains a broken access control vulnerability caused by missing authorization checks, letting attackers abuse privileges, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-86450 No auth
Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal - Broken Access Control
Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal < 1.0.19 contains an access control vulnerability caused by insertion of sensitive information into sent data, letting attackers access functionality not properly constrained by ACLs, exploit requires no special privileges.
- 7.7 /10 HighCVE-2026-86158 No auth
Progress Software Fiddler Everywhere - Authentication Bypass
Progress Software Fiddler Everywhere 8.0.2 contains a broken authentication caused by missing authentication in the local .NET backend (Fiddler.WebUi), letting local unauthenticated attackers mint OAuth tokens and read the machine-in-the-middle root certificate through localhost HTTP and SignalR RPC channels.