High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 349 of 568
- 8.8 /10 HighCVE-2026-94412 Auth required
jshERP - Authorization Bypass
jshERP through 3.6 contains an authorization bypass caused by improper access control in the POST /user/resetPwd endpoint, letting authenticated users reset any other user's password, exploit requires authentication.
- 8.8 /10 HighCVE-2026-94411 Auth required
jshERP - Privilege Escalation
jshERP 3.6 contains a privilege escalation vulnerability caused by improper authorization in the updateOneValueByKeyIdAndType endpoint, letting authenticated users escalate privileges by assigning arbitrary roles.
- 8.8 /10 HighCVE-2026-94403 Auth required
ColorFul iGameCenter - Use After Free
ColorFul iGameCenter 1.0.3.4 contains an untrusted pointer dereference caused by manipulation in the IOCTL Handler component, letting local attackers cause potential memory corruption, exploit requires local access.
- 7.1 /10 HighCVE-2026-94368 Auth required
NooBaa noobaa-core - Broken Access Control
NooBaa noobaa-core contains a broken access control vulnerability caused by improper validation of unsigned x-amz- headers in S3 presigned URLs using Signature Version 4, letting attackers with valid presigned PUT URLs perform unauthorized CopyObject operations, exploit requires possession of a valid presigned PUT URL.
- 8.8 /10 HighCVE-2026-94146 Auth required
BioStar BIOS Update Utility - Write-What-Where Condition
BioStar BIOS Update Utility 1.9.7.3 contains a write-what-where condition caused by manipulation of PhysicalAddress/Size argument in IOCTL Handler sub_110BC, letting local attackers write arbitrary memory, exploit requires local access.
- 7.3 /10 HighCVE-2026-94144 No auth
drogonframework drogon - SQL Injection
drogonframework drogon <= 1.9.13 contains a sql injection caused by manipulation of the "filter" argument in ORM component's makeCriteria function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-94143 No auth
drogonframework drogon - SQL Injection
drogonframework drogon <= 1.9.13 contains a SQL injection caused by manipulation of the "sort" argument in Mapper::orderBy function of ORM Mapper, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-94142 Auth required
BioStar Temperature Monitor Utility - Arbitrary Memory Write
BioStar Temperature Monitor Utility 1.2.1806.2200 contains a write-what-where condition caused by manipulation of the PhysicalAddress argument in IOCTL Handler sub_1105C, letting local attackers write arbitrary memory.
- 7.4 /10 HighCVE-2026-94139 Auth required
Chengdu Feiyuxing Technology Feiyu Star Router - Command Injection
Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656 contains a command injection caused by manipulation of the "session_id" argument in /send_order.cgi, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-94129 PoC publicAuth required
BioStar VALKYRIE AURORA - Write-What-Where Condition
BioStar VALKYRIE AURORA 2.10.2411.0800 contains a write-what-where condition caused by manipulation of the PhysicalAddress argument in IOCTL Handler sub_1105C, letting local attackers write arbitrary memory.
- 8.8 /10 HighCVE-2026-94128 PoC publicAuth required
BioStar VIVID LED - Write-What-Where Condition
BioStar VIVID LED 4.0.2411.1500 contains a write-what-where condition caused by manipulation of the AssociatedIrp argument in IOCTL Handler sub_1105C, letting local attackers write arbitrary memory.
- 7.3 /10 HighCVE-2026-94110 No auth
QCMS - SQL Injection
QCMS <= 6.0.6 contains a SQL injection caused by improper sanitization of the "ID" argument in self_Tmp function of Lib/Config/Controllers.php Content Detail Page, letting remote attackers execute arbitrary SQL commands, exploit requires payloads with literal spaces due to raw REQUEST_URI usage.
- 8.8 /10 HighCVE-2026-92574 Auth required
CRI-O - Broken Access Control
CRI-O 1.34 and later contain a broken access control vulnerability caused by improper enforcement of Kubernetes security context during checkpoint restore, letting users with pod creation permissions execute processes with elevated privileges, exploit requires permission to create pods from malicious checkpointed containers.
- 7.5 /10 HighCVE-2026-91866 No auth
Neethi - Denial of Service
Neethi contains a denial of service caused by specially crafted WS-Policy documents forcing exponential work in policy-intersection, letting attackers pin CPU usage, exploit requires crafted WS-Policy documents.
- 7.5 /10 HighCVE-2026-91865 No auth
Neethi - Denial of Service
Neethi contains a denial of service caused by repeated WS-Policy references re-expansion during normalization, letting attackers consume excessive CPU and memory, exploit requires crafted WS-Policy documents.