High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 39 of 725

  • 8.8 /10 High
    CVE-2026-110196 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.4 contains a remote code execution caused by bypassing administrator-only restriction via a built-in code-execution component, letting low-privileged authenticated attackers execute arbitrary code on the server.

  • 8.8 /10 High
    CVE-2026-110193 Auth required

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.12.8 contains a command injection caused by unblocked patterns in Agentic Assistant component code generation, letting low-privileged authenticated attackers execute arbitrary OS commands remotely.

  • 7.5 /10 High
    CVE-2026-110184 No auth

    Newsmatic WordPress theme - SQL Injection

    Newsmatic WordPress theme <= 1.5.0 contains a blind SQL injection caused by insufficient escaping of the 'slug' parameter in SQL queries, letting unauthenticated attackers extract sensitive database information, exploit requires crafted requests.

  • 7.1 /10 High
    CVE-2026-108494 No auth

    Chained Quiz - Reflected XSS

    Chained Quiz <= 1.4.1 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-107743 No auth

    Mapster WP Maps - Stored XSS

    Mapster WP Maps WordPress plugin <= 2.0.5 contains a stored cross-site scripting caused by improper sanitization and lack of permission checks in /wp-json/mapster-wp-maps/save-mapmaker REST route, letting unauthenticated attackers inject scripts executed on page load.

  • 8.4 /10 High
    CVE-2026-107347

    HashiCorp Nomad - Code Execution

    HashiCorp Nomad and Nomad Enterprise < 2.1.0 contain a symlink following vulnerability during dispatch payload and executor log writes, letting malicious workloads modify files outside their allocation directory, potentially leading to root code execution when client runs as root, exploit requires client agent running as root.

  • 8.8 /10 High
    CVE-2026-107326 PoC publicAuth required

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.12.4 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-107239 Auth required

    Veeam Veeam Management Pack - Remote Code Execution

    Veeam Veeam Management Pack for Microsoft System Center Collector service contains a remote code execution caused by improper access control, letting members of the Veeam Virtualization Extensions Users group execute code remotely, exploit requires membership in the specific user group.

  • 8.7 /10 High
    CVE-2026-107238 Auth required

    Veeam Management Pack - Remote Code Execution

    Veeam Management Pack for Microsoft System Center Collector service contains a remote code execution caused by insufficient privilege restrictions, letting authenticated domain users execute code as LocalSystem remotely, exploit requires authenticated domain user access.

  • 7.5 /10 High
    CVE-2026-107055 No auth

    AppML neutriNote CE - Unrestricted File Upload

    AppML neutriNote CE versionCode 1387 contains an unrestricted file write caused by insecure permissions in the autosave component, letting unauthorized attackers write arbitrary files, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-107052 No auth

    ProjectMAXS MAXS Module FileRead - Path Traversal

    ProjectMAXS MAXS Module FileRead versionCode 27 contains a path traversal caused by insecure permissions in the AIDL interface, letting unauthorized attackers read arbitrary files outside the sandbox, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-107049 No auth

    Forkyz - Broken Access Control

    Forkyz contains a broken access control vulnerability caused by crafted URI strings, letting attackers arbitrarily change another user's storage settings, exploit requires crafted URI input.

  • 7.5 /10 High
    CVE-2026-107047 No auth

    mendhak GPSLogger - Broken Access Control

    mendhak GPSLogger contains insecure permissions caused by improper access control, letting unauthorized attackers manipulate the app's logging mechanism and log data, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-107044 No auth

    ProjectMAXS MAXS Main - Broken Access Control

    ProjectMAXS MAXS Main v0.5.19 contains insecure permissions caused by improper access control in the MAXS command/transport mechanism, letting unauthorized attackers manipulate commands arbitrarily, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-107042 No auth

    USP Ultimate Screenshot Painter - Misconfiguration

    USP Ultimate Screenshot Painter versionCode 240213.009 contains insecure permissions caused by improper content URI handling, letting unauthorized attackers move or overwrite files in another user's private storage, exploit requires crafted content URI.