High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 358 of 568
- 7.5 /10 HighCVE-2026-93749 No auth
source-map-js - Denial of Service
source-map-js <= 1.2.1 contains a denial of service caused by improper validation of per-section offset line values in indexed source maps, letting attackers block the event loop synchronously, exploit requires crafted source maps.
- 7.5 /10 HighCVE-2026-93748 No auth
http-cache-semantics - Information Disclosure
http-cache-semantics <= 4.2.0 contains an information disclosure vulnerability caused by improper validation of security-zeroed cache entries when processing client max-stale directives, letting unauthenticated attackers retrieve cached responses of other users, exploit requires attacker to send requests with large max-stale values.
- 7.5 /10 HighCVE-2026-93690 No auth
uri-js - Denial of Service
uri-js <= 4.4.1 contains a denial of service caused by an infinite loop in removeDotSegments function when path segments start with Unicode line or paragraph separators, letting attackers block the Node.js event loop indefinitely, exploit requires calling removeDotSegments or related functions with IRI enabled.
- 7.5 /10 HighCVE-2026-93688 No auth
SGLang - Denial of Service
SGLang through 0.5.19 contains a denial of service caused by failure to validate bootstrap_room values in prefill/decode disaggregation mode with Mooncake KV transfer backend, letting unauthenticated attackers exhaust memory via POST /generate endpoint.
- 7.5 /10 HighCVE-2026-93687 PoC publicNo auth
Braces - Denial of Service
Braces <= 3.0.3 contains a stack overflow caused by recursive AST walkers lacking depth guards, letting attackers exhaust the call stack and terminate the Node.js process, exploit requires supplying deeply nested brace patterns.
- 8.1 /10 HighCVE-2026-93659 PoC publicNo auth
Concrete CMS Community Store - Stored XSS
Concrete CMS Community Store < 2.7.8 contains a stored XSS caused by lack of HTML escaping in customer-supplied order fields, letting unauthenticated attackers execute scripts in authenticated manager sessions, exploit requires no authentication.
- 7.0 /10 HighCVE-2026-93658 Auth required
uutils coreutils - Privilege Escalation
uutils coreutils < 0.10.0 contains a privilege escalation vulnerability caused by applying setuid or setgid mode before finalizing ownership changes, letting privileged users execute leftover setuid executables with elevated privileges when ownership changes fail.
- 7.5 /10 HighCVE-2026-93657 No auth
hickory-resolver - Authentication Bypass
hickory-resolver < 0.26.2 contains a DNSSEC authentication bypass caused by failure to propagate bogus DNSSEC proof states in Resolver::lookup() and Resolver::lookup_ip() APIs, letting attackers with control over DNS or network path bypass DNSSEC validation.
- 7.5 /10 HighCVE-2026-93652 No auth
µD3TN - Integer Overflow
µD3TN v0.15.0 contains an integer overflow caused by improper handling in TCPCLv3 handshake, letting remote attackers cause a heap overflow leading to denial of service, exploit requires network access.
- 7.2 /10 HighCVE-2026-93604 No auth
vm2 - Privilege Escalation
vm2 <= 3.12.0 contains a privilege escalation caused by exposing crypto.setFips() to untrusted guest code in NodeVM when 'crypto' builtin is allowlisted, letting guest code change host process FIPS mode, exploit requires embedding with 'crypto' builtin allowlisted.
- 7.5 /10 HighCVE-2026-93599
rustls-webpki - Denial of Service
rustls-webpki <= 0.103.12 and 0.104.0-alpha < 0.104.0-alpha.7 contain a denial of service caused by an underflow panic in bit_string_flags() when parsing a crafted CRL with an issuingDistributionPoint extension, letting attackers cause a panic via crafted CRL input, exploit requires explicit CRL revocation checking enabled and attacker-controlled CRL bytes.
- 7.7 /10 HighCVE-2026-93597 Auth required
ArcadeDB - Server Side Request Forgery
ArcadeDB < 26.9.1 contains a server-side request forgery caused by improper validation of IPv6 transition addresses in SSRF guard for IMPORT DATABASE and server commands, letting authenticated attackers reach internal services and cloud metadata endpoints.
- 8.1 /10 HighCVE-2026-93594 Auth required
ArcadeDB - Broken Access Control
ArcadeDB <= 26.8.1 contains a broken access control vulnerability caused by missing permission checks in LSM index and TimeSeries engine query paths, letting authenticated users read and delete index entries bypassing type-level restrictions, exploit requires authenticated user.
- 8.1 /10 HighCVE-2026-93593 Auth required
ArcadeDB - Broken Access Control
ArcadeDB < 26.9.1 contains a broken access control caused by missing type-name-based access checks for TimeSeries types, letting authenticated low-privilege users read or insert TimeSeries samples despite deny rules, exploit requires authentication.
- 7.5 /10 HighCVE-2026-93592 PoC publicNo auth
vLLM - Denial of Service
vLLM < 0.28.0 contains a denial of service caused by lack of validation of lower bound token IDs in /v1/embeddings and /pooling endpoints, letting unauthenticated attackers crash the engine by submitting negative token IDs.