High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 368 of 568
- 7.1 /10 HighCVE-2026-40539 No auth
Synology DiskStation Manager - Improper Certificate Validation
Synology DiskStation Manager (DSM) < 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 contains an improper certificate validation vulnerability in Email API, letting man-in-the-middle attackers read or write arbitrary files and cause denial of service, exploit requires man-in-the-middle position.
- 8.0 /10 HighCVE-2026-40530 Auth required
Synology DiskStation Manager - CRLF Injection
Synology DiskStation Manager (DSM) < 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 contains a CRLF injection caused by improper neutralization of CRLF sequences in User API, letting remote authenticated users read/write arbitrary files and cause denial of service after reboot.
- 8.8 /10 HighCVE-2026-33625 No auth
LMDeploy - Code Injection
LMDeploy 0.12.1 through 0.12.2 contains a code injection vulnerability caused by unsafe eval usage of quantization_config.quant_dtype in lmdeploy/pytorch/config.py, letting attackers execute arbitrary Python code by publishing malicious HuggingFace models, exploit requires loading the crafted model.
- 7.5 /10 HighCVE-2026-32641 No auth
Parseable - Denial of Service
Parseable < 3.0.0 contains a denial of service caused by unwrap() usage on malformed x-amz-firehose-common-attributes header in HTTP middleware, letting remote unauthenticated attackers cause service interruption, exploit requires crafted non-UTF-8 or malformed JSON header.
- 8.8 /10 HighCVE-2026-28198 Auth required
NetBackup Flex OS - Authentication Bypass
NetBackup Flex OS contains a broken authentication vulnerability caused by bypassing cryptographic signature verification in privileged support commands, letting authenticated low-privileged users gain unrestricted root shell access, exploit requires authenticated low-privileged user access to management shell.
- 8.8 /10 HighCVE-2026-28197 Auth required
NetBackup Flex OS - Command Injection
NetBackup Flex OS contains a command injection caused by specially crafted input to a privileged administrative command, letting authenticated low-privileged users execute arbitrary code with root permissions.
- 7.7 /10 HighCVE-2026-18912 Auth required
ManageEngine DataSecurity Plus - SQL Injection
ManageEngine DataSecurity Plus < 6310 contains an authenticated SQL injection caused by improper input sanitization in the Reports module, letting authenticated technicians execute arbitrary SQL queries.
- 7.5 /10 HighCVE-2026-18911
ManageEngine DataSecurity Plus - Authentication Bypass
ManageEngine DataSecurity Plus < 6310 contains an agent authentication bypass caused by improper validation of agent enrollment, letting unenrolled agents send requests without authentication, exploit requires unenrolled agent access.
- 7.5 /10 HighCVE-2026-18442 No auth
WCFM Marketplace – Multivendor Marketplace for WooCommerce - SQL Injection
WCFM Marketplace – Multivendor Marketplace for WooCommerce WordPress plugin <= 3.8.2 contains a SQL injection caused by insufficient escaping of 'wcfmmp_user_location_lng' parameter, letting unauthenticated attackers extract sensitive database information, exploit requires crafted parameter input.
- 7.2 /10 HighCVE-2026-18405 No auth
Jeg Kit for Elementor - Stored Cross-Site Scripting
Jeg Kit for Elementor WordPress plugin <= 3.2.16 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers inject scripts executed when users access affected pages, exploit requires targeted post rendering Jeg Kit Countdown widget.
- 8.6 /10 HighCVE-2026-17619 No auth
IBM Platform RTM - SQL Injection
IBM Platform RTM contains a sql injection caused by improper sanitization of SQL statements, letting remote attackers view, add, modify, or delete information in the back-end database, exploit requires crafted SQL statements.
- 8.8 /10 HighCVE-2026-17086 Auth required
ShortPixel Image Optimizer - Insecure Deserialization
ShortPixel Image Optimizer WordPress plugin <= 6.5.5 contains a PHP Object Injection caused by deserialization of untrusted input, letting authenticated attackers with author-level access inject PHP objects, exploit requires presence of a POP chain in other installed plugins or themes.
- 7.5 /10 HighCVE-2026-15275 No auth
WP Multi Store Locator Pro - SQL Injection
WP Multi Store Locator Pro for WordPress <= 4.5.1 contains a SQL injection caused by insufficient escaping of 'store_locatore_search_radius' parameter in an unquoted numeric SQL context, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-14323 No auth
Printcart Web to Print Product Designer for WooCommerce - Path Traversal
Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 contains a directory traversal caused by improper validation of the 'mockups' parameter, letting unauthenticated attackers read arbitrary files, exploit requires nonce bypass or disabled nonce check.
- 8.8 /10 HighCVE-2026-13673 Auth required
Synology DiskStation Manager - Broken Access Control
Synology DiskStation Manager < 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 contains an incorrect permission assignment vulnerability in LDAP API, letting remote authenticated users read/write arbitrary files and cause denial of service.