High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 369 of 568

  • 8.8 /10 High
    CVE-2026-12954 Auth required

    Mapster WP Maps - Broken Access Control

    Mapster WP Maps WordPress plugin <= 1.23.0 contains an arbitrary user meta write vulnerability caused by lack of nonce verification, capability check, and allowlist validation in my_profile_update(), letting authenticated attackers with Subscriber-level access update arbitrary user meta values.

  • 8.8 /10 High
    CVE-2026-12384 Auth required

    TECHIN2B TECHIN2B Application - Authorization Bypass

    TECHIN2B TECHIN2B Application from V1.0.7676.13 through 18092026 contains an authorization bypass caused by user-controlled key manipulation, letting attackers abuse privileges, exploit requires no special conditions.

  • 8.1 /10 High
    CVE-2026-11727 No auth

    IBM MQ for HPE NonStop - Remote Code Execution & Denial of Service

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 contains a remote code execution and denial of service vulnerability caused by improper validation of queue manager responses when requesting AMS policy data, letting remote attackers cause denial of service or execute arbitrary code.

  • 8.1 /10 High
    CVE-2026-11726 Auth required

    IBM MQ for HPE NonStop - Information Disclosure & Denial of Service

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 contains an information disclosure and denial of service vulnerability caused by improper validation of message header offset values, letting authenticated attackers obtain sensitive information or cause service disruption.

  • 8.8 /10 High
    CVE-2026-11725 Auth required

    IBM MQ - Integer Overflow

    IBM MQ contains an integer overflow caused by improper handling in MQINQ request processing, letting authenticated attackers cause denial of service or execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-11716 Auth required

    IBM MQ for HPE NonStop - Denial of Service & Remote Code Execution

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 contains a denial of service and potential remote code execution caused by improper validation of cluster migration data during queue manager startup, letting authenticated attackers disrupt service or execute code.

  • 8.8 /10 High
    CVE-2026-11381 Auth required

    IBM MQ - Denial of Service & Remote Code Execution

    IBM MQ contains a denial of service and potential remote code execution caused by improper validation of message distribution list structures, letting authenticated attackers disrupt service or execute code.

  • 8.8 /10 High
    CVE-2026-11378 Auth required

    IBM MQ - Integer Overflow

    IBM MQ contains an integer overflow in distribution list processing, letting authenticated attackers cause denial of service or potentially execute arbitrary code, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-11375 Auth required

    IBM MQ - Buffer Overflow

    IBM MQ contains a stack buffer overflow caused by improper processing of XA transaction identifiers, letting authenticated attackers cause denial of service or execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-10853 Auth required

    IBM MQ - Denial of Service & Remote Code Execution

    IBM MQ contains a denial of service and potential remote code execution caused by improper validation of cluster command message lengths, letting authenticated attackers with cluster access disrupt service or execute code.

  • 7.5 /10 High
    CVE-2026-10751 Auth required

    IBM MQ Java and JMS - Remote Code Execution

    IBM MQ Java and JMS client libraries contain an insecure deserialization caused by a deserialization filter bypass in exception handling, letting authenticated attackers execute arbitrary code on client applications.

  • 7.5 /10 High
    CVE-2026-10744 Auth required

    IBM MQ for HPE NonStop - Integer Overflow

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 contains an integer overflow caused by improper MQINQ request validation, letting authenticated attackers cause denial of service or escalate privileges.

  • 8.8 /10 High
    CVE-2026-10575 Auth required

    IBM MQ - Buffer Overflow

    IBM MQ contains a heap buffer overflow caused by processing MQPUT operations with malformed distribution headers, letting authenticated attackers cause denial of service or escalate privileges, exploit requires authentication.

  • 7.1 /10 High
    CVE-2026-10030 Auth required

    IBM MQ Console - Broken Access Control

    IBM MQ Console contains a broken access control vulnerability caused by improper authorization checks, letting authenticated non-administrative users create and start queue managers, exploit requires user authentication.

  • 8.1 /10 High
    CVE-2026-10027

    IBM MQ - Buffer Overflow

    IBM MQ contains a buffer overflow caused by processing malformed compressed data on channels with compression enabled, letting remote attackers cause denial of service or execute arbitrary code, exploit requires compression enabled on channels.