High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 340 of 568

  • 8.8 /10 High
    CVE-2026-88419 Auth required

    WuzhiCMS - Remote Code Execution

    WuzhiCMS 5.0.0 contains an unrestricted file upload vulnerability caused by lack of extension allowlist and content validation in the thumbnail-upload endpoint, letting authenticated low-privileged members execute arbitrary PHP code on the server.

  • 8.8 /10 High
    CVE-2026-88418 No auth

    CMSimple - Stored XSS & Remote Code Execution

    CMSimple 5.24 contains a stored XSS and remote code execution caused by disabled CSRF protection and unsanitized scripting markers in admin content saving, letting unauthenticated attackers execute arbitrary PHP code via a logged-in admin's browser.

  • 8.7 /10 High
    CVE-2026-88415 Auth required

    MCMS - Stored XSS

    MCMS 6.1.1 through 6.2.1 contains a stored XSS caused by exclusion of the article content field 'contentDetails' from the global XSS filter, letting attackers execute scripts on users, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-88345 No auth

    flatcc - Out of Bounds Read

    flatcc 4c3b999e contains an out-of-bounds read caused by unterminated quotation mark in schema lexer lex() function, letting attackers cause application crash and denial of service, exploit requires crafted schema input.

  • 7.5 /10 High
    CVE-2026-88344 No auth

    flatcc - Out-of-Bounds Read

    flatcc 4c3b999e contains an out-of-bounds read caused by an integer digit-scan loop in schema lexer lex() advancing past buffer end when schema ends with a digit, letting attackers cause denial of service via crash, exploit requires crafted schema input.

  • 7.6 /10 High
    CVE-2026-88340 No auth

    YARA - Insecure Deserialization

    YARA 4.5.8 contains an insecure deserialization vulnerability caused by insufficient validation of external-variable pointers during deserialization of compiled .yrc rule files, letting attackers cause memory corruption and application crash, exploit requires crafted .yrc file.

  • 7.5 /10 High
    CVE-2026-87082 No auth

    Net::IDN::Punycode - Denial of Service & Data Tampering

    Net::IDN::Punycode before 2.590 for Perl contains an encoding flaw caused by unvalidated malformed UTF-8 input in encode_punycode, letting attackers cause hangs, crashes, or incorrect labels, exploit requires direct call to encode_punycode with crafted input.

  • 7.5 /10 High
    CVE-2026-87081 No auth

    Net::IDN::UTS46 - Denial of Service

    Net::IDN::UTS46 < 2.590 for Perl contains a denial of service caused by quadratic punycode encoding of an overlong label before length check in to_ascii, letting attackers exhaust CPU resources, exploit requires sending crafted input with many distinct non-ASCII characters.

  • 7.5 /10 High
    CVE-2026-87079 No auth

    Net::IDN::Punycode - Denial of Service

    Net::IDN::Punycode < 2.590 for Perl contains a CPU exhaustion vulnerability caused by quadratic insertion cost in decode_punycode when decoding long labels, letting attackers cause denial of service, exploit requires attacker to supply long labels.

  • 7.8 /10 High
    CVE-2026-86054 No auth

    Notepad++ - Buffer Overflow

    Notepad++ < 8.9.8 contains a stack buffer overflow caused by unbounded wcscpy and wcscat operations in NppParameters::writeSession, letting attackers cause denial of service by triggering stack canary termination, exploit requires a long settings directory path.

  • 7.3 /10 High
    CVE-2026-85995

    Notepad++ - Remote Code Execution

    Notepad++ 8.9.7 to 8.9.8 contains a code execution vulnerability caused by improper validation of the updater's embedded certificate, letting attackers launch modified code via the updater path, exploit requires file replacement.

  • 7.1 /10 High
    CVE-2026-85740 Auth required

    LightRAG - Server Side Request Forgery

    LightRAG < 1.5.5 contains a server-side request forgery caused by improper validation of IPv4 addresses embedded in IPv6 transition wrappers in _validated_addresses, letting attackers fetch internal resources via crafted external image URLs, exploit requires document upload capability.

  • 8.6 /10 High
    CVE-2026-85279 No auth

    Notepad++ - Buffer Overflow

    Notepad++ < 8.9.8 contains a stack buffer overflow caused by unchecked plugin-supplied GetLexerCount() results in PluginsManager::loadPluginFromPath, letting malicious plugins execute arbitrary code, exploit requires malicious or compromised plugin.

  • 7.1 /10 High
    CVE-2026-84395 No auth

    Premiere Pro - Privilege Escalation

    Premiere Pro contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-83963 No auth

    Substance3D - Out-of-Bounds Write

    Substance3D - Modeler contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.