High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 331 of 568
- 7.8 /10 HighCVE-2026-91792 No auth
Foxit PDF Editor/Reader - Denial of Service
Foxit PDF Editor/Reader contains a use-after-free caused by reentrant zoom and layout operations triggered by page- and annotation-related JavaScript actions, letting attackers cause application crashes, exploit requires crafted PDF.
- 7.8 /10 HighCVE-2026-91791 No auth
Foxit PDF Editor/Reader - Denial of Service
Foxit PDF Editor/Reader contains a use-after-free vulnerability caused by reentrant JavaScript execution triggered by page-visibility events, letting attackers cause application crash via invalid memory read, exploit requires crafted PDF file.
- 7.8 /10 HighCVE-2026-91790 No auth
Foxit PDF Editor/Reader - Use After Free
Foxit PDF Editor/Reader contains a use after free caused by improper validation of malformed optional content attributes in image objects, letting attackers trigger a crash, exploit requires crafted PDF file.
- 7.8 /10 HighCVE-2026-91789 No auth
Foxit PDF Editor/Reader - Remote Code Execution
Foxit PDF Editor/Reader contains a buffer overflow caused by insufficient validation of image dimensions in U3D/GIF texture decoding, letting remote attackers execute code via crafted images, exploit requires crafted PDF files.
- 7.5 /10 HighCVE-2026-91777
FasterXML jackson-databind - Denial of Service
FasterXML jackson-databind contains a performance issue caused by linear scanning of pending-reference accumulator in identity-enabled collections or maps, letting attackers cause quadratic CPU usage during deserialization, exploit requires deserialization of attacker-controlled JSON.
- 7.5 /10 HighCVE-2026-91776
FasterXML jackson-databind - Denial of Service
FasterXML jackson-databind contains a memory retention vulnerability caused by caching fallback deserializers for unrecognized type IDs in name-based polymorphism with defaultImpl, letting attackers cause memory exhaustion, exploit requires attacker-controlled type IDs and long-lived ObjectMapper.
- 7.2 /10 HighCVE-2026-90905 No auth
Joomla Easy Store - Cross-Site Request Forgery
Joomla Easy Store extension 1.0.0-3.0.0 contains a cross-site request forgery caused by missing CSRF token verification and access control in site configuration update endpoint, letting attackers modify mail configuration via forged admin requests, exploit requires admin privileges.
- 8.6 /10 HighCVE-2026-90904 Auth required
Joomla Easy Store - Broken Access Control
Joomla Easy Store extension 1.0.0-3.0.0 contains a broken access control vulnerability caused by a hardcoded true return in allowEdit() method in ApiController.php, letting authenticated backend users edit any record, bypassing ACL checks.
- 7.2 /10 HighCVE-2026-90903 No auth
Joomla Extension joomshaper.com Easy Store - Cross-Site Request Forgery
Joomla Extension joomshaper.com Easy Store 1.0.0-3.0.0 contains a cross-site request forgery caused by missing CSRF token verification in multiple administrator AJAX API endpoints, letting attackers trick logged-in administrators into unauthorized state changes, exploit requires administrator login.
- 8.6 /10 HighCVE-2026-90902 Auth required
Joomla Easy Store - SQL Injection
Joomla Easy Store extension 1.0.0-3.0.0 contains an authenticated, privileged SQL injection caused by unsanitized input concatenated into raw SQL IN clauses in coupon bulk update, letting authenticated administrators execute arbitrary SQL, exploit requires administrator privileges.
- 8.6 /10 HighCVE-2026-90901 Auth required
Joomla Easy Store - Information Disclosure
Joomla Easy Store extension 1.0.0-3.0.0 contains an information disclosure caused by unauthenticated access to the checkout.searchGuestUser endpoint, letting unauthenticated attackers retrieve guest shipping details, exploit requires no authentication.
- 8.2 /10 HighCVE-2026-90899 No auth
Joomla Easy Store - Broken Access Control
Joomla Easy Store extension 1.0.0-3.0.0 contains an IDOR vulnerability caused by unauthenticated access to the checkout.searchGuestUser endpoint, letting unauthenticated attackers access guest PII via email enumeration, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-89425 No auth
FasterXML jackson-core - Denial of Service
FasterXML jackson-core >= 2.8.0 contains an out-of-bounds error caused by unbounded token accumulation in UTF8DataInputJsonParser._reportInvalidToken(), letting attackers cause JVM OutOfMemoryError, exploit requires malformed token input via DataInput parser.
- 7.3 /10 HighCVE-2026-88832 Auth required
BusyBox - Buffer Overflow
BusyBox contains a heap buffer overflow caused by unbounded strlen on attacker-controlled romfs volume ID metadata, letting attackers cause memory corruption via crafted filesystem images, exploit requires crafted filesystem image.
- 7.5 /10 HighCVE-2026-88830 No auth
BusyBox - Buffer Overflow
BusyBox contains a heap buffer overflow caused by unit confusion in TLS Montgomery reduction buffer allocation when processing a crafted ClientKeyExchange message, letting remote attackers cause memory corruption, exploit requires crafted message.