High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 341 of 568
- 7.8 /10 HighCVE-2026-83962 No auth
Substance3D Modeler - Buffer Overflow
Substance3D Modeler contains a stack-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 8.4 /10 HighCVE-2026-83603 PoC public
Netdata - Command Injection
Netdata < 2.10.4 contains a command injection caused by unsafe deserialization via a caller-controlled --socket_path in ndsudo helper, letting low-privileged attackers execute code as root, exploit requires fail2ban-client installed.
- 7.5 /10 HighCVE-2026-83599 No auth
Netdata - Denial of Service
Netdata < 2.11.0 contains a denial of service caused by unbounded decompressed output growth in websocket_client_decompress_message() before authentication, letting unauthenticated attackers exhaust server memory via compressed WebSocket frames.
- 7.8 /10 HighCVE-2026-83598 Auth required
Netdata - Privilege Escalation
Netdata 2.0.0 to 2.10.4 contains a privilege escalation caused by powershell.exe running as SYSTEM without -NoProfile during Windows Agent MSI repair, letting low-privileged users execute commands with SYSTEM privileges, exploit requires initiating MSI repair.
- 7.0 /10 HighCVE-2026-83597 Auth required
Netdata Windows Agent - Privilege Escalation
Netdata Windows Agent 2.0.0 to 2.10.4 contains a privilege escalation caused by launching elevated interactive processes during MSI repair, letting low-privileged local users execute commands with SYSTEM privileges, exploit requires local user to trigger repair.
- 8.5 /10 HighCVE-2026-82003
Adobe Campaign Classic - Remote Code Execution
Adobe Campaign Classic contains an improper input validation vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires conditions beyond attacker control.
- 8.7 /10 HighCVE-2026-81999 Auth required
Adobe Experience Manager Forms JEE - Privilege Escalation
Adobe Experience Manager Forms JEE contains a server-side request forgery caused by improper validation of URLs, letting attackers with high privileges escalate access to internal resources, exploit requires high privileges.
- 7.8 /10 HighCVE-2026-81998 No auth
Substance3D Modeler - Remote Code Execution
Substance3D Modeler contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 7.5 /10 HighCVE-2026-80150 No auth
Lantronix SLC8000 & EMG8500/EMG7500 & SLB882 - Server-Side Request Forgery
Lantronix SLC8000 < 9.7.0.3, EMG8500/EMG7500 < 9.7.0.1, and all SLB882 firmware versions contain a server-side request forgery caused by manipulation of the rooturl parameter in WebSSH/WebTelnet listener, letting unauthenticated attackers redirect Telnet connections to attacker-controlled hosts, exploit requires no authentication.
- 8.6 /10 HighCVE-2026-80149 No auth
Lantronix SLC8000 & EMG8500/EMG7500 & SLB882 - Server-Side Request Forgery
Lantronix SLC8000 < 9.7.0.3, EMG8500/EMG7500 < 9.7.0.1, and all SLB882 firmware versions contain a server-side request forgery caused by manipulation of the rooturl parameter in WebSSH/WebTelnet listener, letting unauthenticated attackers make SSH connections to attacker-controlled endpoints, exploit requires no authentication.
- 8.6 /10 HighCVE-2026-80148 No auth
Lantronix SLC8000 - Server Side Request Forgery
Lantronix SLC8000 < 9.7.0.3, EMG8500/EMG7500 < 9.7.0.1, and all SLB882 firmware versions contain a server-side request forgery caused by improper input handling in WebSSH/WebTelnet listener, letting unauthenticated attackers redirect SSH connections to attacker-controlled hosts, exploit requires sending crafted overlong username strings.
- 7.8 /10 HighCVE-2026-79906 No auth
Substance3D Modeler - Remote Code Execution
Substance3D - Modeler contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code as the current user, exploit requires victim to open a malicious file.
- 8.8 /10 HighCVE-2026-79314 Auth required
x-ui - Privilege Escalation
x-ui 0.3.2 contains a horizontal privilege escalation caused by lack of ownership verification in inbound proxy configuration update path, letting authenticated users modify other users' proxy settings, exploit requires authentication.
- 7.1 /10 HighCVE-2026-77633 Auth required
Cloudreve - Denial of Service
Cloudreve < 4.18.0 contains a denial of service caused by race condition in storage quota enforcement in PrepareUpload, letting authenticated users with Files.Write permission exhaust host storage, exploit requires concurrent upload requests.
- 7.8 /10 HighCVE-2026-77605 No auth
Notepad++ - Command Injection
Notepad++ < 8.9.8 contains a command injection caused by improper resolution of sibling files in Folder as Workspace Run by system action, letting attackers execute arbitrary scripts as the current user, exploit requires user to invoke Run by system on a crafted file.