High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 362 of 568

  • 7.5 /10 High
    CVE-2026-86520

    Bransys ELD - Hardcoded Credentials

    Bransys ELD contains hardcoded MQTT credentials, letting attackers read real-time data from active devices connected to the affected MQTT broker, exploit requires access to the MQTT broker.

  • 7.7 /10 High
    CVE-2026-85887 Auth required

    Microsoft 365 Copilot - Information Disclosure

    Microsoft 365 Copilot contains an information disclosure vulnerability caused by incorrect permission assignment for a critical resource, letting authorized attackers disclose information over a network, exploit requires attacker authorization.

  • 7.5 /10 High
    CVE-2026-85705 No auth

    Location Manager WordPress plugin - SQL Injection

    Location Manager WordPress plugin <= 2.3.38 contains a SQL injection caused by insufficient escaping of 'latitude' and 'longitude' REST API parameters, letting unauthenticated attackers extract sensitive database information, exploit requires orderby=lat_lon parameter.

  • 8.1 /10 High
    CVE-2026-85410 Auth required

    Master Addons for Elementor - Authorization Bypass

    Master Addons for Elementor WordPress plugin <= 3.2.2 contains an authorization bypass caused by improper user authorization verification in popup management, letting authenticated contributors modify or delete arbitrary posts, exploit requires contributor-level access.

  • 8.8 /10 High
    CVE-2026-85127 No auth

    VikBooking Hotel Booking Engine & PMS - Stored XSS

    VikBooking Hotel Booking Engine & PMS WordPress plugin < 1.8.15 contains a stored XSS caused by unrestricted file types and unsanitized contents in live chat attachments, letting unauthenticated visitors execute active content in admin context, exploit requires admin to view the conversation.

  • 8.8 /10 High
    CVE-2026-85122 No auth

    WhiteStudio Easy Form Builder - Stored XSS

    WhiteStudio Easy Form Builder WordPress plugin < 4.2.0 contains a stored XSS caused by lack of validation of submitted values against stored configuration in some form types, letting unauthenticated attackers store and render arbitrary content unescaped in admin page.

  • 7.5 /10 High
    CVE-2026-85058 No auth

    Moquette - Broken Access Control

    Moquette < 0.18.1 contains a broken access control vulnerability caused by missing authorization checks in Last Will message publishing, letting remote clients inject messages into ACL-protected topics, exploit requires anonymous access enabled.

  • 7.4 /10 High
    CVE-2026-84975

    PJSIP - Authentication Bypass

    PJSIP <= 2.17 contains a server impersonation vulnerability caused by improper handling of DNS SubjectAltName with embedded NUL bytes in OpenSSL and GnuTLS backends, letting attackers with a trusted certificate and interception capability impersonate servers, exploit requires attacker to intercept connection and possess a trusted certificate.

  • 7.5 /10 High
    CVE-2026-84447 No auth

    libheif - Denial of Service

    libheif <= 1.23.1 contains a denial of service caused by crafted grid, iovl, and iden reference graphs leading to repeated decoding of the same base image, letting attackers cause resource exhaustion, exploit requires crafted input files.

  • 7.5 /10 High
    CVE-2026-84446 No auth

    libheif - Denial of Service

    libheif < 1.23.2 contains a denial of service caused by integer overflow in sample timing calculations, letting attackers cause non-terminating decode loops and severe CPU/memory exhaustion, exploit requires crafted HEIF files.

  • 7.4 /10 High
    CVE-2026-84444 No auth

    libheif - Buffer Overflow

    libheif < 1.23.2 with WITH_UNCOMPRESSED_CODEC enabled contains a heap buffer overflow caused by missing component size checks in heif_context_add_image_tile, letting attackers cause memory corruption, exploit requires crafted HEIF/AVIF files.

  • 7.5 /10 High
    CVE-2026-84398 No auth

    CM2507 IP cameras - Authentication Bypass

    CM2507 IP cameras contain a broken authentication caused by accepting an empty password for a privileged account via ONVIF management service, letting attackers with network access obtain privileged management functions and sensitive configuration information, exploit requires network access to the device.

  • 7.5 /10 High
    CVE-2026-84384 No auth

    libheif - Denial of Service

    libheif 1.19.0 to < 1.23.2 contains a denial of service caused by unbounded memory growth in decompress_brotli() and do_inflate() when processing crafted HEIF or AVIF metadata, letting attackers cause process termination, exploit requires crafted file input.

  • 8.1 /10 High
    CVE-2026-84241 No auth

    IBM Guardium Data Protection - Broken Access Control

    IBM Guardium Data Protection 12.2 contains a broken access control caused by improper authorization, letting remote attackers bypass security restrictions, exploit requires network access.

  • 7.6 /10 High
    CVE-2026-84239 Auth required

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.2 contains a SQL injection caused by improper neutralization of special elements in an SQL command, letting remote authenticated attackers obtain sensitive information.