High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 374 of 568

  • 8.1 /10 High
    CVE-2026-92984 No auth

    HUBzero CMS - Authentication Bypass

    HUBzero CMS through 2.2.32 contains a session fixation vulnerability caused by acceptance of session identifiers from query strings and request variables instead of cookies alone, letting unauthenticated attackers hijack victim sessions by sending crafted links, exploit requires victim to authenticate after receiving crafted link.

  • 7.5 /10 High
    CVE-2026-92983 No auth

    InternLM LMDeploy - Denial of Service

    InternLM LMDeploy through 0.17.0 contains a denial of service caused by proxy using user-facing session IDs instead of internal scheduler keys in DistServe prefill/decode disaggregation mode, letting unauthenticated attackers exhaust memory, exploit requires sending completion requests to proxy endpoint.

  • 7.2 /10 High
    CVE-2026-92980 Auth required

    HortusFox-Web - Remote Code Execution

    HortusFox-Web < 6.1 contains a remote code execution caused by abuse of Import/Export functionality, letting authenticated administrators execute arbitrary OS commands as the web server user.

  • 8.6 /10 High
    CVE-2026-92972 No auth

    SGLang - Broken Access Control

    SGLang through 0.5.19 contains an insecure endpoint in prefill bootstrap service allowing unauthenticated attackers to poison KV transfer routing table by supplying arbitrary rank_ip and rank_port, causing denial of service or information disclosure.

  • 7.5 /10 High
    CVE-2026-92971 No auth

    InternLM LMDeploy - Denial of Service

    InternLM LMDeploy through 0.17.0 contains a denial of service caused by a reachable assertion in the DistServe decode migration loop, letting unauthenticated attackers crash the inference engine by submitting a crafted migration_request.

  • 8.8 /10 High
    CVE-2026-92970 Auth required

    HUBzero CMS - Path Traversal

    HUBzero CMS through 2.2.32 contains a path traversal caused by improper validation in project file upload handlers, letting authenticated project members write arbitrary files outside the project repository, potentially enabling code execution.

  • 7.5 /10 High
    CVE-2026-92961 No auth

    vm2 - Denial of Service

    vm2 before 3.11.6 contains a denial of service caused by failure to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, letting attackers exhaust host memory, exploit requires crafted input using V8 intrinsics.

  • 7.1 /10 High
    CVE-2026-92959 Auth required

    vm2 - Asynchronous Execution Bypass

    vm2 before 3.11.8 contains an asynchronous execution bypass caused by incomplete enforcement of the allowAsync: false option in VM and NodeVM, letting sandboxed scripts execute code after VM.run() returns, exploit requires sandboxed code execution.

  • 8.5 /10 High
    CVE-2026-92958 Auth required

    vm2 - Sandbox Bypass

    vm2 <= 3.11.6 contains a builtin-module denylist bypass caused by improper matching of negative entries in NodeVM builtin module restrictions, letting sandboxed code access restricted fs/promises APIs, exploit requires crafted require configuration.

  • 8.6 /10 High
    CVE-2026-92954 No auth

    vm2 - Denial of Service

    vm2 >= 3.10.0 and <= 3.11.7 contains a denial of service caused by unhandled host Promises in the sandbox bridge, letting sandboxed code trigger host process termination, exploit requires invoking host functions returning rejected Promises.

  • 8.6 /10 High
    CVE-2026-92950 No auth

    vm2 - Remote Code Execution

    vm2 < 3.11.7 contains a sandbox escape vulnerability caused by re-execution of malicious scripts using require(__filename) in the CLI tool, letting attackers execute arbitrary code in the host Node.js process, exploit requires supplying a malicious script file.

  • 8.1 /10 High
    CVE-2026-92943

    AWS IoT Device SDK for Python - Man-in-the-Middle

    AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later contains a man-in-the-middle vulnerability caused by improper validation of certificates with host mismatch in the MQTT client TLS layer, letting adversaries impersonate AWS IoT Core endpoints and read or inject MQTT messages, exploit requires attacker to be in a man-in-the-middle position.

  • 7.5 /10 High
    CVE-2026-92942

    vm2 - Denial of Service

    vm2 <= 3.11.6 contains a denial of service caused by improper enforcement of VM({ timeout }) option allowing sandboxed code to block the host event loop via FinalizationRegistry cleanup callbacks, exploit requires triggering garbage collection.

  • 7.3 /10 High
    CVE-2026-92926 No auth

    code-projects Matrimonial System - SQL Injection

    code-projects Matrimonial System 1.0 contains a sql injection caused by manipulation of the "education" argument in /partner_preference.php writepartnerprefs function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.1 /10 High
    CVE-2026-92925 No auth

    Redis - Out-of-Bounds Read

    Redis community cluster bus contains an out-of-bounds read vulnerability caused by improper null-termination validation of string-carrying extensions in PING/PONG/MEET packet parser, letting remote attackers cause information disclosure or denial of service, exploit requires crafted packet.