High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 365 of 568
- 8.2 /10 HighCVE-2026-81627 Auth required
QEMU - Privilege Escalation
QEMU contains a privilege escalation caused by improper validation of writable RAM alias in VAPIC setup hypercall, letting privileged guest users inject code into System Management Mode memory, exploit requires privileged guest access.
- 8.6 /10 HighCVE-2026-81626 No auth
IBM Guardium Data Protection - SQL Injection
IBM Guardium Data Protection 12.2 contains a SQL injection caused by unsanitized input in the Load Balancer Groups component via the Load Balancer Servlet endpoint, letting unauthenticated attackers access and manipulate data remotely, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-81180 Auth required
SysReptor Professional - Remote Code Execution
SysReptor Professional < 2026.61 contains a code injection vulnerability caused by image processing invoking Ghostscript and a race condition with GnuPG configuration, letting authenticated users execute arbitrary code with application privileges, exploit requires authenticated user.
- 8.1 /10 HighCVE-2026-81179 No auth
SysReptor - Open Redirect
SysReptor < 2026.58 contains an open redirect caused by accepting attacker-controlled Host header in password reset link generation, letting unauthenticated attackers reset victim passwords via crafted reset emails, exploit requires email gateway and victim email.
- 8.8 /10 HighCVE-2026-77929 Auth required
ClipBucket - Remote Code Execution
ClipBucket v5 < 5.5.3-#182 contains a remote code execution caused by improper file extension update after MIME validation in FileUpload::manageFile(), letting authenticated users execute PHP code via photo upload endpoint.
- 7.5 /10 HighCVE-2026-77301 No auth
adm-zip - Denial of Service
adm-zip < 0.6.1 contains a denial of service caused by trusting uncompressed size in central-directory leading to excessive memory allocation in getData(), letting attackers exhaust memory via crafted ZIP archives, exploit requires processing untrusted ZIP files.
- 8.1 /10 HighCVE-2026-77239 Auth required
WACRM - Broken Access Control
WACRM <= 0.7.0 contains a broken access control vulnerability caused by missing agent role enforcement in flow and automation write routes, letting authenticated account viewers modify workflows and trigger actions, exploit requires authenticated viewer role.
- 7.5 /10 HighCVE-2026-75895 No auth
libsmpp35 - Out of Bounds Read
libsmpp35 0.1.0 through 1.8.0 contains an out of bounds read caused by improper handling of attacker-controlled SMPP PDUs in smpp34_unpack() function, letting attackers cause memory corruption, exploit requires crafted SMPP PDUs.
- 7.5 /10 HighCVE-2026-75894 No auth
osmo-iuh - Denial of Service
osmo-iuh 0.1.0 through 1.8.0 contains a denial of service caused by a reachable assertion failure in the ranap_handle_co_dt() function via an arbitrarily sized NAS-PDU, letting remote attackers crash the process, exploit requires network access.
- 7.5 /10 HighCVE-2026-75893 No auth
osmo-bsc - Buffer Overflow
osmo-bsc 1.0.1 through 1.14.1 contains a buffer overflow caused by improper handling of IPA frame lengths in ipaccess_proxy_read_msg() function, letting attackers cause memory corruption, exploit requires crafted IPA frames.
- 7.5 /10 HighCVE-2026-75157 PoC publicNo auth
Apache Airflow - Broken Access Control
Apache Airflow contains a broken access control vulnerability caused by checking DAG permission with READ instead of EDIT on asset queued-events DELETE endpoints, letting authenticated users delete queued asset events, exploit requires authenticated user with DAG read access.
- 7.5 /10 HighCVE-2026-71418 No auth
Suricata - Denial of Service
Suricata 8.0.0 to 8.0.6 contains a denial of service caused by improper clearing of internal buffer in DNS-over-HTTP/2 processing in rust/src/http2/http2.rs, letting attackers cause CPU overload and packet loss, exploit requires sending multiple HTTP/2 DATA frames with EndOfStream flag.
- 7.3 /10 HighCVE-2026-7006 Auth required
Sublime Text - Privilege Escalation
Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation caused by abuse of the update staging mechanism allowing malicious DLL placement, letting unprivileged local attackers execute code with elevated privileges, exploit requires local access.
- 7.5 /10 HighCVE-2026-69184 No auth
c-ares - Denial of Service
c-ares < 1.34.7 contains a denial of service caused by unbounded DNS compression pointer hops in ares_dns_name_parse(), letting malicious DNS servers stall the event loop, exploit requires crafted DNS response.
- 8.6 /10 HighCVE-2026-68928 No auth
Acode - Command Injection
Acode 1.11.6 to 1.12.7 contains a command injection caused by an exported TerminalService without binding permission and lack of caller verification, letting local attackers execute commands with Acode's privileges, exploit requires local app installation.