High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 345 of 568
- 7.5 /10 HighCVE-2026-65118 No auth
NVIDIA Infrastructure Controller for Linux - Improper Certificate Validation
NVIDIA Infrastructure Controller for Linux contains an improper certificate validation vulnerability, letting attackers cause information disclosure, data tampering, and denial of service, exploit requires no special conditions.
- 8.3 /10 HighCVE-2026-65114 No auth
NVIDIA Infrastructure Controller for Linux - Authentication Bypass
NVIDIA Infrastructure Controller for Linux contains a broken authentication vulnerability caused by missing authentication for a critical function, letting attackers tamper data, cause denial of service, and disclose information, exploit requires no special conditions.
- 7.8 /10 HighCVE-2026-65111 Auth required
NVIDIA NeMo Speech - Command Injection
NVIDIA NeMo Speech contains a command injection caused by malicious input processing, letting attackers execute code, disclose information, and tamper data, exploit requires crafted malicious input.
- 8.1 /10 HighCVE-2026-63104 Auth required
Kaneo - Broken Access Control
Kaneo 2.3.12 before 2.12.2 contains a broken access control vulnerability caused by missing role-based permission checks in the bulk task endpoint, letting authenticated workspace members with viewer or member roles delete or modify tasks beyond their permissions, exploit requires authenticated workspace membership.
- 7.5 /10 HighCVE-2026-62985 No auth
request-filtering-agent - Denial of Service
request-filtering-agent < 3.2.1 contains an uncaught exception vulnerability caused by synchronous throw in createConnection for private IP hosts, letting attackers cause application crash, exploit requires sending requests to private IPs.
- 7.5 /10 HighCVE-2026-61685 No auth
ReactPress - SQL Injection
ReactPress prior to 3.7.0 contains a SQL injection caused by unsanitized HTTP query parameter names used as SQL column identifiers in TypeORM QueryBuilder, letting unauthenticated attackers inject SQL, exploit requires crafted query string keys.
- 7.5 /10 HighCVE-2026-61570 No auth
MPXJ - XML External Entity Injection
MPXJ 5.5.5 to <16.4.1 contains an XML external entity injection caused by enabled doctype declarations and external entities in MerlinReader parsing ZTIMEINTERVALS column, letting attackers read arbitrary local files, exploit requires crafted database.
- 7.5 /10 HighCVE-2026-59991 No auth
psd-tools - Denial of Service
psd-tools prior to 1.17.4 contains a denial of service caused by unvalidated attacker-controlled PSD header geometry in PSDImage.composite() and PSDImage.numpy(), letting attackers cause excessive memory allocation and service termination, exploit requires processing crafted PSD files.
- 7.5 /10 HighCVE-2026-58268 No auth
SIPGO - Denial of Service
SIPGO < 1.4.1 contains a denial of service caused by client-controlled Content-Length header allocating excessive memory in ParserStream.parseSingle, letting unauthenticated peers cause resource exhaustion, exploit requires sending oversized message length.
- 7.3 /10 HighCVE-2026-56681 No auth
9Router - Authentication Bypass
9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation.
- 7.5 /10 HighCVE-2026-43643 No auth
Softaculous Virtualizor - Authorization Bypass
Softaculous Virtualizor < 3.2.9 (Patch 9) and 3.0.0 contain an authorization bypass caused by improper validation in the billing module handler, letting unauthenticated remote attackers modify tenant account balances via crafted parameters.
- 8.1 /10 HighCVE-2026-43642 No auth
Softaculous Virtualizor - Remote Code Execution
Softaculous Virtualizor < 3.2.9 (Patch 9) and 3.0.0 contain a PHP object injection caused by unsafe unserialize() usage in the billing module handler, letting unauthenticated remote attackers achieve remote code execution as root, exploit requires crafted POST request with specific parameters.
- 8.6 /10 HighCVE-2026-34689 No auth
Adobe Connect - Path Traversal
Adobe Connect contains a path traversal caused by improper limitation of pathname to restricted directory, letting attackers read arbitrary files outside intended scope, exploit requires no user interaction.
- 8.8 /10 HighCVE-2026-28325 No auth
SolarWinds Observability Self-Hosted - Remote Code Execution
SolarWinds Observability Self-Hosted contains an insecure deserialization vulnerability caused by deserialization of untrusted data in a specific communication mode, letting unauthenticated remote attackers execute arbitrary code.
- 8.8 /10 HighCVE-2026-25265
Unknown - Privilege Escalation
Unknown product contains a privilege escalation caused by weak configuration in temporary file handling, letting attackers escalate privileges, exploit requires specific weak configuration.