High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 303 of 628

  • 7.2 /10 High
    CVE-2026-103766 Auth required

    ClipBucket - SQL Injection

    ClipBucket v5 through 5.5.3-#197 contains an SQL injection caused by improper sanitization of the delete parameter in admin_area/ads_manager.php, letting authenticated users with ad_manager_access inject SQL to extract or modify data.

  • 8.8 /10 High
    CVE-2026-103631 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 154.0.8037.97 contains a buffer overflow in WebRTC, caused by improper handling of data, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-103625 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 154.0.8037.97 contains a remote code execution caused by type confusion in V8 engine, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-103624

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free vulnerability in Contextual Tasks, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 8.8 /10 High
    CVE-2026-103623 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free caused by improper memory handling in MediaStream, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-103622 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free vulnerability in SVG, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 7.3 /10 High
    CVE-2026-103552 No auth

    Apache Directory LDAP API - Denial of Service

    Apache Directory LDAP API >= 1.2.0 < 1.2.9 contains a stack overflow caused by processing deeply nested search filters in the server's decoder, letting remote attackers cause denial of service, exploit requires sending crafted nested filters.

  • 7.2 /10 High
    CVE-2026-103426 No auth

    Relevanssi Premium WordPress - Stored XSS

    Relevanssi Premium WordPress plugin <= 2.31.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the '_rt' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires click-tracking and logging enabled.

  • 7.5 /10 High
    CVE-2026-103098

    Generic Application - Information Disclosure

    An application transmits a sensitive key in the URL over an unencrypted HTTP connection, letting attackers intercept the key via network traffic, exploit requires network access to monitor traffic.

  • 7.5 /10 High
    CVE-2026-103097 No auth

    Android Application - Hardcoded Credentials

    An Android application contains hardcoded API keys retrievable from the application package, letting unauthorized users extract and misuse sensitive credentials, exploit requires reverse engineering the app.

  • 7.5 /10 High
    CVE-2026-103096 No auth

    Android Application - Hardcoded Credentials

    An Android application contains a hardcoded API key in the application package, allowing attackers who reverse engineer the app to retrieve and misuse the key, exploit requires access to the application package.

  • 7.2 /10 High
    CVE-2026-102772 No auth

    CMB2 WordPress Plugin - Stored Cross-Site Scripting

    CMB2 WordPress plugin <= 2.13.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in '<textarea_code field id>' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires public exposure of CMB2 form with textarea_code field.

  • 7.5 /10 High
    CVE-2026-102731 No auth

    Apache Directory LDAP API - Denial of Service

    Apache Directory LDAP API 1.2.0 to < 1.2.9 contains a denial of service caused by excessive memory allocation from small BER-encoded responses, letting attackers cause OutOfMemoryError and service disruption, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-102565 No auth

    BA Book Everything WordPress Plugin - Stored XSS

    BA Book Everything WordPress plugin <= 1.8.28 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'booking_service_qty' parameter, letting unauthenticated attackers inject scripts executed by admin users, exploit requires admin to view injected order.

  • 7.7 /10 High
    CVE-2026-101104 Auth required

    Meari IoT Cloud Platform - Broken Access Control

    Meari IoT Cloud Platform OpenAPI Service contains an authorization flaw caused by improper ownership verification, letting authenticated users manipulate configurations of devices they do not own, exploit requires user authentication.