High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 337 of 568

  • 7.1 /10 High
    CVE-2026-18177 No auth

    IBM Financial Transaction Manager (FTM) - Broken Access Control

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken access control vulnerability caused by missing authorization checks, letting remote attackers execute unauthorized payment actions, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-15358 No auth

    ZohoCorp ManageEngine OpManager & Network Configuration Manager - Path Traversal

    ZohoCorp ManageEngine OpManager and Network Configuration Manager < 12.8.671 contain an unauthorized path traversal vulnerability caused by improper input validation, letting attackers access arbitrary files, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-15027 No auth

    Changing CGServiSign - OS Command Injection

    Changing CGServiSign contains an OS command injection caused by unsanitized input in the local service interface, letting unauthenticated remote attackers execute arbitrary OS commands by inducing victim interaction.

  • 8.8 /10 High
    CVE-2026-14913 Auth required

    ZohoCorp ManageEngine OpManager & Firewall Analyzer - SQL Injection

    ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.669 contain an SQL injection caused by improper sanitization in Rule Management Search Reports, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted requests.

  • 8.2 /10 High
    CVE-2026-14321 No auth

    divi-dash WordPress Plugin - Broken Access Control

    divi-dash WordPress plugin < 1.0.7 contains a broken access control vulnerability caused by lack of validation of client IP source, letting unauthenticated attackers spoof IPs to bypass rate limiting and cause denial of service, exploit requires no authentication.

  • 7.6 /10 High
    CVE-2026-12370 Auth required

    ZohoCorp ManageEngine - Server-Side Template Injection

    ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager <= 12.8.667 contain a server-side template injection caused by unsafe Configlet processing, letting remote attackers execute arbitrary code remotely, exploit requires no special privileges.

  • 8.6 /10 High
    CVE-2022-4997 No auth

    jet-form-builder-stripe-gateway WordPress - SQL Injection

    jet-form-builder-stripe-gateway WordPress plugin < 1.1.0 contains a SQL injection caused by unsanitised and unescaped payment token in SQL statements, letting unauthenticated attackers extract arbitrary database data including password hashes, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-95862 No auth

    UniFi Gateway - Denial of Service

    UniFi gateway devices contain an out-of-bounds write vulnerability that allows a network attacker to cause denial of service, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-95861 No auth

    UniFi Gateway - Denial of Service

    UniFi gateway devices contain an uncontrolled recursion vulnerability caused by improper input handling, letting network attackers cause denial of service, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-95831 No auth

    Crypt::SelfCertificate - Remote Code Execution

    Crypt::SelfCertificate 1.01 through 1.05 for Perl contains a remote code execution vulnerability caused by execution of a Python script from an obfuscated URL in certificate files, letting attackers invoke arbitrary code as the user, exploit requires installation of affected versions.

  • 7.3 /10 High
    CVE-2026-95819 No auth

    anirbandutta9 College-Notes-Gallery - SQL Injection

    anirbandutta9 College-Notes-Gallery contains a SQL injection caused by manipulation of user/pass arguments in login.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 8.1 /10 High
    CVE-2026-95814 Auth required

    Vaultwarden - Broken Access Control

    Vaultwarden through 1.37.3 contains a broken access control vulnerability caused by omission of organization membership status validation in cipher access queries, letting revoked or pending members retain unauthorized cipher access, exploit requires revoked or pending membership.

  • 7.3 /10 High
    CVE-2026-95656 No auth

    dgtlmoon changedetection.io - Server-Side Request Forgery

    dgtlmoon changedetection.io <= 50389b07 contains a server-side request forgery caused by manipulation of the "url" argument in add_watch_ui_snapshot of Preview Endpoint, letting remote attackers make arbitrary requests, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-95655 Auth required

    Aureus ERP - Broken Access Control

    Aureus ERP < 1.5.0 contains a broken access control caused by failure to scope message lookups in ChatterPanel, letting authenticated users read, edit, delete, or pin arbitrary messages across departments or companies, exploit requires user authentication.

  • 7.4 /10 High
    CVE-2026-95654

    Databasement - Broken Access Control

    Databasement < 1.7.14 contains a broken access control vulnerability caused by caching authorization decisions without re-checking invitation token validity, letting attackers with leaked invitation links overwrite account passwords and gain access, exploit requires leaked or forwarded invitation link.