High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 348 of 568
- 7.5 /10 HighCVE-2026-94626
vLLM - Denial of Service
vLLM through 0.29.0 contains an unbounded memory allocation vulnerability caused by failure to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, letting attackers exhaust memory and trigger kernel OOM-kill, exploit requires attacker to supply arbitrary tp_size values in prefill/decode disaggregated deployments.
- 7.5 /10 HighCVE-2026-94624 No auth
vLLM - Denial of Service
vLLM through 0.29.0 contains a denial of service vulnerability caused by unreachable peer sessions in P2P KV offloading with OffloadingConnector configured with TieringOffloadingSpec and a peer-to-peer secondary tier, letting attackers crash EngineCore and stop all inference, exploit requires supplying arbitrary remote host and port values.
- 7.5 /10 HighCVE-2026-94623 No auth
vLLM - Denial of Service
vLLM through 0.29.0 contains a denial of service vulnerability caused by improper validation of block counts in the NIXL connector's prefix caching during multi-prompt completion requests, letting attackers cause worker termination, exploit requires crafted multi-prompt requests.
- 7.5 /10 HighCVE-2026-94622 No auth
vLLM - Denial of Service
vLLM <= 0.29.0 contains a denial of service vulnerability caused by uncaught KeyError in EngineCore scheduling due to incomplete kv_transfer_params in NIXL connector metadata handling, letting attackers cause decode engine termination, exploit requires crafted requests with incomplete parameters.
- 7.7 /10 HighCVE-2026-94540 No auth
DesktopSMS - Broken Access Control
DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability caused by lack of pairing confirmation in the local service, letting local attackers transmit SMS, retrieve SMS content, and persist paired identity without user interaction.
- 7.1 /10 HighCVE-2026-94535 Auth required
lamp-cloud - Authorization Bypass
lamp-cloud <= 5.10.0 contains an authorization bypass caused by lack of recipient validation in the deleteMyNotice endpoint, letting authenticated users delete other users' notifications.
- 7.1 /10 HighCVE-2026-94534 Auth required
lamp-cloud - Broken Access Control
lamp-cloud <= 5.10.0 contains a broken access control caused by failure to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, letting authenticated attackers modify arbitrary user profiles by supplying target user IDs.
- 8.8 /10 HighCVE-2026-94501 Auth required
jshERP - Authorization Bypass
jshERP through 3.6 contains an authorization bypass caused by missing privilege checks in userBusiness CRUD endpoints, letting authenticated users manipulate user-role mappings and escalate privileges.
- 8.3 /10 HighCVE-2026-94497 Auth required
jshERP - Broken Access Control
jshERP through 3.6 contains a broken access control vulnerability caused by failure to validate object ownership in by-id info, update, and delete endpoints, letting authenticated users read, modify, and delete other users' business objects, exploit requires authentication.
- 8.3 /10 HighCVE-2026-94496 Auth required
jshERP - Broken Access Control
jshERP <= 3.6 contains a broken access control vulnerability caused by failure to validate caller permissions in role management endpoints, letting authenticated users escalate privileges and modify roles, exploit requires authentication.
- 7.1 /10 HighCVE-2026-94495 Auth required
jshERP - Broken Access Control
jshERP <= 3.6 contains a broken access control vulnerability caused by improper validation of user privileges in SystemConfigService.updateSystemConfig, letting authenticated users modify tenant system configuration through the systemConfig endpoint.
- 8.2 /10 HighCVE-2026-94488 No auth
Telegram Desktop - Stored XSS
Telegram Desktop < 6.9.4 contains a stored XSS caused by improper sanitization in HTML exporter component button.text.toUtf8, letting attackers execute scripts via exported HTML, exploit requires victim to use HTML export.
- 7.5 /10 HighCVE-2026-94449 No auth
SmallRye Fault Tolerance - Denial of Service
SmallRye Fault Tolerance library used by Quarkus contains a memory leak caused by failure to release internal tracking objects after each request when using ApplyGuard or ApplyFaultTolerance annotations, letting attackers cause denial of service by exhausting memory, exploit requires usage of these annotations.
- 8.8 /10 HighCVE-2026-94425 Auth required
Moore Threads MTT S80 Driver Package - Broken Access Control
Moore Threads MTT S80 Driver Package 340.150 contains a broken access control caused by improper privilege management in IOCTL Handler function sub_140006F0C, letting local attackers escalate privileges, exploit requires local access.
- 8.8 /10 HighCVE-2026-94424 Auth required
Moore Threads MTT S80 Driver Package - Buffer Overflow
Moore Threads MTT S80 Driver Package <= 340.150 contains a heap-based buffer overflow caused by improper handling in IOCTL Handler function sub_140001000, letting local attackers cause memory corruption, exploit requires local access.