High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 306 of 628

  • 8.6 /10 High
    CVE-2026-88789 PoC publicNo auth

    Apache Camel Quarkus - XML External Entity Injection

    Apache Camel Quarkus 3.2.0 before 3.33.3 and 3.34.0 before 3.40.0 contains an XML External Entity Injection caused by insecure Xalan-backed TransformerFactory in the XSLT support extension, letting attackers read local files or access internal network via crafted XML, exploit requires supplying malicious XML document.

  • 7.5 /10 High
    CVE-2026-86344 No auth

    389-ds-base - Denial of Service

    389-ds-base contains a denial of service caused by unauthenticated remote attacker sending incomplete LDAPMessage sequences, letting attacker exhaust worker-thread pool and block service, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-85679 No auth

    Extendify WordPress plugin - Stored XSS

    Extendify WordPress plugin <= 3.1.6 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'styles.blocks' block type key, letting unauthenticated attackers inject scripts executed on page access, exploit requires unauthenticated POST, PUT, or PATCH requests to /wp/v2/global-styles.

  • 7.2 /10 High
    CVE-2026-85235 No auth

    Forminator Forms - Stored XSS

    Forminator Forms WordPress plugin <= 1.57.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Rich-Text Textarea Field, letting unauthenticated attackers inject scripts executed when an admin interacts with the injected content.

  • 8.8 /10 High
    CVE-2026-82828 Auth required

    Hitachi Coding Software Suite - Broken Access Control

    Hitachi Coding Software Suite <= 3.3.0 contains an incorrect authorization vulnerability caused by improper access control, letting unprivileged users perform administrator-level operations, exploit requires unprivileged user access.

  • 7.5 /10 High
    CVE-2026-82826 No auth

    Hitachi Coding Software Suite - Cleartext Transmission of Sensitive Information

    Hitachi Coding Software Suite <= 3.3.0 contains a cleartext transmission of sensitive information vulnerability caused by unencrypted data transmission, letting attackers eavesdrop on authentication credentials and sensitive data in transit, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-81809 No auth

    Paytm Payment Gateway WordPress plugin - SQL Injection

    Paytm Payment Gateway WordPress plugin < 2.8.9 contains a SQL injection caused by improper escaping of payment callback data and forgable integrity checks, letting unauthenticated attackers execute arbitrary SQL commands.

  • 7.5 /10 High
    CVE-2026-81739 No auth

    Paytm Payment Gateway WordPress - Stored XSS

    Paytm Payment Gateway WordPress plugin < 2.8.9 contains a stored XSS caused by unsanitized payment callback data and forged integrity checks, letting unauthenticated users execute scripts in admin sessions, exploit requires gateway enabled without credentials.

  • 7.5 /10 High
    CVE-2026-80276 No auth

    Comelit Multi-User Gateway - Authentication Bypass

    Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 contain an information disclosure vulnerability caused by an unauthenticated network-accessible management interface, letting remote attackers read sensitive configuration data including the Remote Configuration Password in cleartext, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-80275 Auth required

    Comelit Multi-User Gateway - Broken Access Control

    Comelit Multi-User Gateway for VIP System (model 1456B) 2.9.1 and 2.10.0 contain a broken access control caused by missing server-side authorization on administrative password-change function, letting authenticated users overwrite administrator passwords, exploit requires user authentication.

  • 7.9 /10 High
    CVE-2026-79899 Auth required

    Fortra BoKS Manager - Information Disclosure

    Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert caused by predictable temporary file creation without restrictive umask, letting local users access CA secret or host private keys, exploit requires local access to BOKS_tmp directory.

  • 7.5 /10 High
    CVE-2026-79896 No auth

    Fortra BoKS Manager - Denial of Service

    Fortra BoKS Manager contains an out-of-bounds read caused by a malformed TLS ClientHello in boks_portmux, letting remote unauthenticated attackers cause service interruption, exploit requires no special privileges.

  • 8.4 /10 High
    CVE-2026-73975 Auth required

    djehuty - SQL Injection

    djehuty < 26.3.2 contains a SPARQL injection caused by crafted session name in state-modifying queries, letting authenticated depositors write and delete arbitrary triples in the shared RDF store, exploit requires logged-in account.

  • 7.3 /10 High
    CVE-2026-73637 No auth

    Apache HTTP Server - Authentication Bypass

    Apache HTTP Server < 2.4.69 contains a use after free vulnerability in mod_auth_digest caused by concurrent Digest authentication requests with AuthDigestNcCheck enabled or AuthDigestNonceLifetime set to 0, letting unauthenticated remote clients cause authentication state corruption.

  • 8.1 /10 High
    CVE-2026-73636

    Apache HTTP Server - Authentication Bypass

    Apache Software Foundation Apache HTTP Server 2.4.x contains an authentication bypass caused by replaying captured digest authentication credentials via crafted requests triggering garbage collection in mod_auth_digest, letting man-in-the-middle attackers bypass authentication, exploit requires AuthDigestNonceLifetime set to 0.