High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 326 of 568

  • 7.2 /10 High
    CVE-2026-96656 Auth required

    Plex Media Server - Unrestricted File Upload

    Plex Media Server < 1.43.3.10861 contains an unrestricted file write vulnerability caused by appending the TranscoderH264Options preference verbatim to x264's option string, letting admin users write arbitrary files that execute on load, exploit requires admin privileges.

  • 7.3 /10 High
    CVE-2026-96604 No auth

    SoftNews Media Group DataLife Engine - SQL Injection

    SoftNews Media Group DataLife Engine 18.0 contains a SQL injection caused by manipulation of the "story" argument in engine/modules/search.php strip_data function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-96603 No auth

    Abdurrab5 online-makeup-store - Broken Access Control

    Abdurrab5 online-makeup-store contains a broken access control caused by manipulation of the "adminid" argument in confirm_logged_in/confirm_user function of Admin Handler, letting remote attackers bypass authorization, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-96602 No auth

    Abdurrab5 online-makeup-store - SQL Injection

    Abdurrab5 online-makeup-store contains a sql injection caused by manipulation of username/password arguments in customerSignin.php Customer Login Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-96601 No auth

    Abdurrab5 online-makeup-store - SQL Injection

    Abdurrab5 online-makeup-store contains a SQL injection caused by manipulation of "id" or "password" arguments in Admin Login Handler in index.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-96556 No auth

    Neethuharii CafeManagement - Broken Access Control

    Neethuharii CafeManagement contains a broken access control caused by manipulation of uname/pass/role/status arguments in AddCashierCode.php addcashier function, letting remote attackers perform improper authorization, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-96541 No auth

    gnome-remote-desktop - Denial of Service

    gnome-remote-desktop contains a denial-of-service caused by lack of pre-authentication handshake deadline enforcement in RDP connections, letting unauthenticated remote attackers exhaust connection slots, exploit requires no authentication.

  • 7.3 /10 High
    CVE-2026-96514 No auth

    Neethuharii CafeManagement - SQL Injection

    Neethuharii CafeManagement contains a sql injection caused by manipulation of the "uname" argument in CafePortalLogin.php Login Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-96513 No auth

    Neethuharii CafeManagement - Unrestricted File Upload

    Neethuharii CafeManagement contains an unrestricted file upload vulnerability caused by manipulation of the "image" argument in AddProductCode.php, letting remote attackers upload arbitrary files, exploit requires no special privileges.

  • 7.8 /10 High
    CVE-2026-96512 PoC publicAuth required

    sudo - Broken Access Control

    sudo contains a broken access control vulnerability caused by reliance on the TZ environment variable for time-based sudoers rules, letting unprivileged local users execute commands outside intended time windows, exploit requires local user privileges.

  • 8.8 /10 High
    CVE-2026-96455

    Reachy Mini - Authentication Bypass

    Reachy Mini daemon contains an authentication bypass in the POST /apps/install HTTP API endpoint, caused by lack of credential checks, letting any network attacker install and run arbitrary code on the robot, exploit requires network access to the wireless unit.

  • 8.2 /10 High
    CVE-2026-96454 No auth

    Pake - Broken Access Control

    Pake applications built on Tauri contain a broken access control vulnerability caused by overly permissive IPC access and unprotected app commands, letting any script on any HTTPS page invoke native commands, exploit requires running script in the application.

  • 7.8 /10 High
    CVE-2026-96442 No auth

    Emacs - Remote Code Execution

    Emacs < 31.2 contains a remote code execution caused by Flymake mode executing arbitrary code from edited files during syntax checking, letting attackers execute code with user privileges, exploit requires opening untrusted files.

  • 8.8 /10 High
    CVE-2026-96275

    Flatpak - Unrestricted File Upload

    Flatpak contains an unrestricted file write caused by improper path resolution and lack of sanitization in extract_extra_data(), letting attackers write arbitrary files as root on system installs, exploit requires malicious or compromised repository.

  • 7.5 /10 High
    CVE-2026-96272 No auth

    ClipBucket - SQL Injection

    ClipBucket v5 < 5.5.3-#182 contains a blind SQL injection caused by unsanitized query parameter in photo search endpoint's SQL WHERE and ORDER BY clauses, letting unauthenticated attackers extract sensitive user data, exploit requires crafted requests.