High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 366 of 568
- 7.6 /10 HighCVE-2026-67549 PoC publicNo auth
OpenImageIO - Buffer Overflow
OpenImageIO < 3.1.16.0 contains a heap out-of-bounds write caused by improper bit conversion in TIFFInput::read_native_scanline_locked() when processing crafted 1-bit contiguous CMYK TIFF images, letting attackers cause memory corruption, exploit requires crafted TIFF file.
- 7.6 /10 HighCVE-2026-67103 Auth required
HCL BigFix Service Management - Stored XSS
HCL BigFix Service Management contains a stored XSS vulnerability caused by unsanitized script injection, letting attackers execute malicious scripts in victim browsers, exploit requires victim interaction.
- 8.1 /10 HighCVE-2026-67102 Auth required
HCL BigFix Service Management - Broken Access Control
HCL BigFix Service Management contains a broken access control vulnerability caused by insufficient privilege checks, letting low-privileged users access administrative screens and functions, exploit requires low-privileged user access.
- 8.3 /10 HighCVE-2026-63638 PoC publicNo auth
OpenImageIO - Out of Bounds Read/Write
OpenImageIO < 3.0.21.0, < 3.1.16.0, and < 3.2.0.3-beta1 contain a heap out-of-bounds write caused by improper bit depth handling in cineoninput::read_native_scanline, letting attackers cause memory corruption remotely, exploit requires crafted cineon image.
- 7.5 /10 HighCVE-2026-63452 No auth
Suricata - Denial of Service
Suricata 8.0.0 to 8.0.6 contains a denial of service caused by unbounded processing of multiple small Brotli compression bombs in HTTP/1 parser, letting attackers degrade packet processing, exploit requires sending repeated compressed responses in a single flow.
- 7.5 /10 HighCVE-2026-63447 No auth
Suricata - Denial of Service
Suricata 8.0.5 to 8.0.6 contains a denial of service caused by continued allocation of FTP transactions beyond max-tx limit in the FTP parser, letting attackers degrade packet processing, exploit requires crafted FTP traffic.
- 7.5 /10 HighCVE-2026-63446 No auth
Suricata - Denial of Service
Suricata 8.0.0 to 8.0.6 contains a denial of service caused by improper transaction inspection marking in AppLayerParserSetTransactionInspectId, letting attackers cause CPU and memory exhaustion by triggering repeated rescans, exploit requires network traffic triggering pass rules.
- 7.8 /10 HighCVE-2026-63422 PoC publicNo auth
OpenImageIO - Out of Bounds Read/Write
OpenImageIO < 3.0.21.0, < 3.1.16.0, and < 3.2.0.3-beta1 contain a heap out-of-bounds write caused by incorrect handling of partial edge-tile rectangles in OpenEXRInput::read_native_tiles(), letting attackers cause memory corruption remotely, exploit requires crafted tiled openexr image with width not multiple of tile width.
- 7.8 /10 HighCVE-2026-63419 PoC publicNo auth
OpenImageIO - Buffer Overflow
OpenImageIO < 3.0.21.0, < 3.1.16.0, and < 3.2.0.3-beta1 contain a heap out-of-bounds write caused by incorrect buffer size handling in iffinput::read_native_tile(), letting attackers cause memory corruption remotely, exploit requires crafted image files.
- 7.1 /10 HighCVE-2026-62279 Auth required
LubeLogger - Broken Access Control
LubeLogger < 1.6.8 contains a broken access control vulnerability caused by missing authorization checks on source vehicle records in DuplicateRecordsToOtherVehicles endpoint, letting authenticated users copy records from other users, exploit requires authentication.
- 8.1 /10 HighCVE-2026-62278 Auth required
LubeLogger - Path Traversal
LubeLogger < 1.6.8 contains a path traversal caused by improper validation of uploaded file paths in HandleTranslationFileUpload, letting authenticated non-admin users place or overwrite files outside intended directories.
- 8.1 /10 HighCVE-2026-6205 Auth required
Synology DiskStation Manager - Unrestricted File Upload
Synology DiskStation Manager (DSM) < 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 contains an unrestricted file write vulnerability caused by external control of file name or path in Upload API, letting remote authenticated users write arbitrary files and cause denial of service.
- 8.1 /10 HighCVE-2026-61833 Auth required
Zot - Broken Access Control
Zot < 2.1.18 contains a broken access control vulnerability caused by improper permission checks on DELETE requests in bearer authentication handler, letting remote attackers with push permissions delete manifests and blobs, exploit requires bearer token with push and pull permissions.
- 8.5 /10 HighCVE-2026-61821 Auth required
pg_partman - Broken Access Control
pg_partman prior to 5.5.0 contains a broken access control vulnerability caused by improper schema privilege checks in drop_partition_id() and drop_partition_time(), letting roles with partman_user access relocate child tables between schemas without proper authorization, exploit requires partman_user role access.
- 8.5 /10 HighCVE-2026-61820 Auth required
pg_partman - Command Injection
pg_partman < 5.5.0 contains a command injection caused by improper escaping of double quotes in primary-key column names in inherit_template_properties(), letting a partman_user with template table ownership execute OS commands with superuser privileges, exploit requires crafted column names.