High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 338 of 568
- 7.5 /10 HighCVE-2026-95653 No auth
Concrete CMS Community Store - Broken Access Control
Concrete CMS Community Store < 2.7.8 contains an information disclosure caused by predictable digital product download tokens derived from order creation timestamps, letting unauthenticated attackers retrieve digital goods of other customers, exploit requires no authentication.
- 7.7 /10 HighCVE-2026-95619 No auth
libstdc++ - Integer Overflow
libstdc++ contains an integer overflow caused by processing large inputs to the C++ new operator, letting attackers cause memory corruption or application instability, exploit requires crafted input.
- 7.4 /10 HighCVE-2026-95508
libslirp - Buffer Overflow
libslirp contains a heap-based buffer overflow caused by improper handling of DHCPv6 CLIENTID or TFTP blksize options with small interface MTU, letting attackers cause denial of service or remote code execution, exploit requires small MTU configuration.
- 7.3 /10 HighCVE-2026-95500 No auth
JosephChuks php-file-manager-with-code-editor - Unrestricted File Upload
JosephChuks php-file-manager-with-code-editor <= 3.0 contains an unrestricted file upload vulnerability caused by manipulation of filename/content arguments in file_put_contents of codeEditor.php Save Handler, letting remote attackers upload arbitrary files, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-95499 No auth
JosephChuks php-file-manager-with-code-editor - Unrestricted File Upload
JosephChuks php-file-manager-with-code-editor <= 3.0 contains an unrestricted file upload vulnerability caused by improper validation in move_uploaded_file function in filemanager.php, letting remote attackers upload arbitrary files, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-95271 No auth
dgtlmoon changedetection.io - Authentication Bypass
dgtlmoon changedetection.io <= 0.60.7 contains an authentication bypass caused by improper handling in check_authentication function in Authentication Hook, letting remote attackers bypass authentication, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-94640 No auth
rpcbind - Denial of Service
rpcbind contains a denial of service vulnerability caused by unbounded in-memory list growth from unique RPC requests, letting remote unauthenticated attackers exhaust service availability, exploit requires no special privileges.
- 7.8 /10 HighCVE-2026-94574 No auth
GNU wget - Code Execution
GNU wget Windows builds from eternallybored.org contain a local code execution vulnerability caused by a hardcoded writable configuration file path C:\msys64, letting unprivileged users execute arbitrary code locally, exploit requires local access.
- 7.2 /10 HighCVE-2026-94504 CISA KEVPoC publicNo auth
Ninja Forms - Stored XSS
Ninja Forms 3.15.3 contains a stored XSS caused by unsafe rendering of anonymous non-RTE textarea values in the legacy submission editor, letting attackers execute scripts in the WordPress admin origin, exploit requires administrator to open a crafted submission URL.
- 7.3 /10 HighCVE-2026-94491 No auth
Yonyou KSOA - SQL Injection
Yonyou KSOA 9.0 contains a sql injection caused by manipulation of the "address" argument in /cardcase/search_list.jsp, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.1 /10 HighCVE-2026-94462 Auth required
Spree - Broken Access Control
Spree 5.4.0 to 5.4.4 and 5.5.4 contain an information disclosure caused by lack of cart token verification in cart association, letting authenticated customers access guest cart address data, exploit requires guest cart with address data and no login required for checkout.
- 7.1 /10 HighCVE-2026-94455 Auth required
Enterprise Provisioning Service - Broken Access Control
An HTTP endpoint for provisioning enterprise and reseller organisations lacks authentication middleware, allowing attackers with a valid user session token to create high-tier organisations and obtain valid API keys.
- 7.5 /10 HighCVE-2026-94450 No auth
s2n-quic - Denial of Service
s2n-quic <= 1.88.0 contains a denial of service caused by improper validation of Destination Connection ID length in server endpoints configured to send Retry packets, letting unauthenticated remote attackers shut down the server via crafted UDP datagram.
- 8.1 /10 HighCVE-2026-94384 Auth required
Amazon amazon-connect-salesforce-lambda - Broken Access Control
Amazon amazon-connect-salesforce-lambda < 5.26 contains a broken access control caused by missing authorization in Lambda function dispatching caller-supplied parameters to privileged AWS APIs, letting any IAM principal with lambda:InvokeFunction permission escalate privileges, exploit requires lambda:InvokeFunction permission.
- 7.6 /10 HighCVE-2026-94117 Auth required
DevItems HashBar – WordPress Notification Bar - SQL Injection
DevItems HashBar – WordPress Notification Bar <= 2.0.3 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.