High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 336 of 568

  • 7.5 /10 High
    CVE-2026-61814 No auth

    Jawn - Denial of Service

    Jawn < 1.7.0 contains a denial of service caused by quadratic processing in AsyncParser when a single JSON token is delivered in many small chunks, letting remote attackers exhaust CPU resources, exploit requires crafted JSON input.

  • 7.5 /10 High
    CVE-2026-61695 No auth

    Wire Swift - Denial of Service

    Wire Swift runtime < 6.4.1 and < 7.0.0-alpha04 contains a denial of service caused by accepting negative length in LENGTH_DELIMITED field inside unknown START_GROUP, letting attackers crash the process remotely without authentication.

  • 7.5 /10 High
    CVE-2026-59990 No auth

    Jawn - Denial of Service

    Jawn < 1.7.0 contains a denial of service caused by lack of depth limit in JSON parsing, letting remote attackers exhaust JVM heap via deeply nested JSON, exploit requires submission of untrusted JSON.

  • 8.7 /10 High
    CVE-2026-55610 Auth required

    InvoiceShelf - Broken Access Control

    InvoiceShelf < 2.4.1 contains a broken access control vulnerability caused by improper user ownership verification in multi-company installations, letting company owners read and overwrite user accounts across companies, exploit requires owner privileges.

  • 7.4 /10 High
    CVE-2026-42801 Auth required

    ASR Crane Falcon - Denial of Service

    ASR Crane Falcon on Linux contains a null pointer dereference vulnerability caused by improper pointer manipulation in as_rrc module (3g.mod/lib/src/urrsir.c), letting attackers cause denial of service, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-31377

    Apache Doris - Authentication Bypass

    Apache Doris 2.0.0 to 4.1.4 contains an improper authentication vulnerability caused by relying on client-supplied node information for authentication in the Frontend meta service, letting unauthenticated remote attackers access internal metadata endpoints, exploit requires specific network configurations.

  • 7.5 /10 High
    CVE-2026-19888 No auth

    PgBouncer - Denial of Service

    PgBouncer through 1.25.2 contains a null pointer dereference caused by missing validation of a mandatory attribute in the SCRAM client-final-message parser, letting unauthenticated remote attackers cause a denial of service by crashing the process, exploit requires no valid account.

  • 7.5 /10 High
    CVE-2026-19438 No auth

    ABB Mint Workbench I - Path Traversal

    ABB Mint Workbench I <= 5876 contains a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory, letting attackers access unauthorized files, exploit requires no special privileges.

  • 8.2 /10 High
    CVE-2026-19179 No auth

    IBM Financial Transaction Manager - SQL Injection

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a SQL injection caused by improper neutralization of special elements in a boolean expression, letting remote attackers manipulate database queries, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-19125 PoC publicNo auth

    EthPress Web3 Login - Authentication Bypass

    EthPress – Web3 Login WordPress plugin <= 2.3.5 contains an authentication bypass caused by missing return in signature verification in app/Login.php, letting unauthenticated attackers log in as any user, exploit requires crafted signature.

  • 7.3 /10 High
    CVE-2026-18875 No auth

    IBM Financial Transaction Manager - Template Injection

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a template injection caused by unauthenticated runbook upsert in the FTM AI agent server, letting unauthenticated attackers trigger unauthorized payment actions or exfiltrate payment data.

  • 8.8 /10 High
    CVE-2026-18490

    IBM Financial Transaction Manager - Remote Code Execution

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an insecure deserialization vulnerability in PayDir Business Rules Manager RMI SSL endpoint, letting adjacent-network attackers execute arbitrary code remotely, exploit requires network adjacency.

  • 7.3 /10 High
    CVE-2026-18185 No auth

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift - Broken Access Control

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken access control vulnerability caused by missing authentication for a critical function, letting remote attackers access sensitive information and modify system configurations, exploit requires no special privileges.

  • 7.4 /10 High
    CVE-2026-18184 No auth

    IBM Financial Transaction Manager (FTM) - XML External Entity Injection

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an XML external entity injection flaw caused by improper XML input processing, letting remote attackers obtain sensitive information, exploit requires crafted XML input.

  • 8.1 /10 High
    CVE-2026-18181 No auth

    IBM Financial Transaction Manager - Authentication Bypass

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken authentication caused by a hard-coded cryptographic key, letting remote attackers bypass authentication and access sensitive information, exploit requires no special conditions.