High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 350 of 568

  • 7.5 /10 High
    CVE-2026-91864 No auth

    Neethi - Denial of Service

    Neethi contains a denial of service caused by unbounded content in WS-Policy assertions leading to heap exhaustion, letting attackers cause service disruption, exploit requires crafted WS-Policy document.

  • 7.5 /10 High
    CVE-2026-91863 No auth

    Neethi - Denial of Service

    Neethi contains a denial of service caused by a specially crafted WS-Policy document with deeply nested policy elements bypassing the nesting-depth limit, letting attackers crash the parser remotely, exploit requires crafted WS-Policy document.

  • 7.1 /10 High
    CVE-2026-90860

    Canva Mobile App - Broken Access Control

    Canva Mobile App for HarmonyOS < 1.15.1 contains a broken access control vulnerability caused by unrestricted headers returned to external origins in privileged WebView, letting attackers access user sessions, exploit requires control of the WebView.

  • 7.5 /10 High
    CVE-2026-88806

    libX11 - Buffer Overflow

    libX11 < 1.8.14 contains a buffer overflow caused by improper handling of XkbGetMap overflowing the key_sym_map, letting a malicious X server execute arbitrary code, exploit requires a malicious X server.

  • 7.1 /10 High
    CVE-2026-88746 No auth

    idccms - Stored XSS

    idccms V1.70 contains a stored XSS caused by improper input sanitization in /admin/makeDiy_deal.php, letting attackers execute scripts in the context of other users, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-88738 Auth required

    Jazzware RT1000 Edge webUI - Unrestricted File Upload

    Jazzware RT1000 Edge webUI 20.0.1 contains an unrestricted file upload vulnerability caused by lack of validation in upgrade package upload functionality, letting authenticated attackers upload executable files leading to remote code execution.

  • 7.5 /10 High
    CVE-2026-88411 No auth

    FalkorDB Redis module - Denial of Service

    FalkorDB Redis module v4.20.1 contains a denial of service caused by improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c), letting attackers cause application crash, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-88410 Auth required

    FalkorDB Redis module - Misconfiguration

    FalkorDB Redis module v4.20.1 to v4.20.4 contains a misclassification of graph.UDF command caused by it not being registered as a write command, letting attackers cause unexpected application behavior, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-88409 Auth required

    FalkorDB Redis module - Buffer Overflow

    FalkorDB Redis module v4.20.1 to v4.20.4 contains a buffer overflow caused by improper handling in _Decode_GrB_Matrix function, letting attackers cause denial of service via crafted input, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-88407 No auth

    FalkorDB Redis module - Denial of Service

    FalkorDB Redis module 4.20.1 to 4.20.4 contains an out-of-bounds read caused by improper handling in node_token_count/relation_token_count, letting attackers cause denial of service via crafted input.

  • 7.5 /10 High
    CVE-2026-88406 No auth

    FalkorDB Redis module - Denial of Service

    FalkorDB Redis module v4.20.1 to v4.20.4 contains a stack overflow caused by improper validation in _ValidateUnion_Clauses function in /ast/ast_validations.c, letting attackers cause denial of service via crafted input.

  • 8.8 /10 High
    CVE-2026-84990 Auth required

    ntopng - Broken Access Control

    ntopng < 6.7.260718 contains a broken access control vulnerability caused by lack of administrator check in backup listing and download scripts, letting authenticated non-admin users download backups exposing sensitive credentials, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-84285 Auth required

    Tuleap Enterprise Edition - Command Injection

    Tuleap Enterprise Edition >= 17.3 and <= 17.5 contains an OS command injection caused by improper input sanitization, letting attackers execute arbitrary commands on the server, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-83621 Auth required

    ntopng - Broken Access Control

    ntopng < 6.7.260717 contains a broken access control vulnerability caused by missing administrator check in edit_blacklist.lua, letting authenticated non-admin users modify threat-intelligence settings, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-82412 Auth required

    ntopng - Command Injection

    ntopng < 6.7.260717 contains a command injection caused by improper validation of scan_ports parameter in vulnerability-scan endpoints, letting authenticated non-admin users or attackers via CSRF execute OS commands as ntopng process, exploit requires authenticated user or CSRF attack.