High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 395 of 568

  • 7.3 /10 High
    CVE-2026-92366 No auth

    code-projects Matrimonial System - SQL Injection

    code-projects Matrimonial System 1.0 contains a sql injection caused by manipulation of arguments sex, mothertongue, maritialstatus, country, state, religion, agemin, agemax in /search.php Regular Search component, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-92362 No auth

    ag-ui-protocol ag-ui - Denial of Service

    ag-ui-protocol ag-ui 1.0 contains a denial of service caused by manipulation in SSE Frame Parser in crates/ag-ui-client/src/sse.rs, letting remote attackers cause resource consumption, exploit requires no special conditions.

  • 7.4 /10 High
    CVE-2026-92299 No auth

    @jitsi/electron-sdk - Information Disclosure

    @jitsi/electron-sdk < 10.0.5 contains an information disclosure caused by exposing getDesktopSources() via contextBridge without requiring active getDisplayMedia() picker, letting attackers enumerate screens and windows and retrieve desktop thumbnails without user consent or OS permission prompts, exploit requires attacker to run script in meeting page.

  • 7.3 /10 High
    CVE-2026-92215 No auth

    a2ui-project a2ui - Server-Side Request Forgery

    a2ui-project a2ui <= 0.10.7 contains a server-side request forgery caused by manipulation of httpx.get in FileResolver component, letting remote attackers initiate SSRF, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-92137 Auth required

    Jenkins Robot Framework Plugin - Remote Code Execution

    Jenkins Robot Framework Plugin <= 6.2.2 contains a file write vulnerability caused by lack of validation on archive directory path, letting attackers with Item/Configure permission write arbitrary files, potentially leading to remote code execution.

  • 8.0 /10 High
    CVE-2026-92136 Auth required

    Jenkins OWASP Dependency-Check Plugin - Stored XSS

    Jenkins OWASP Dependency-Check Plugin <= 5.6.4 contains a stored XSS caused by unescaped CWE values in Dependency-Check reports on the Jenkins UI, letting attackers with Item/Configure permission execute scripts persistently.

  • 8.0 /10 High
    CVE-2026-92135 Auth required

    Jenkins Coverage Plugin - Stored XSS

    Jenkins Coverage Plugin <= 3.3358.v9487dde48783 contains a stored XSS caused by lack of validation of coverage results ID in job configuration via REST API, letting attackers with Item/Configure permission execute stored scripts.

  • 8.0 /10 High
    CVE-2026-92134 Auth required

    Jenkins Warnings Plugin - Stored XSS

    Jenkins Warnings Plugin <= 13.10258.va_17d49a_78c3b_ contains a stored cross-site scripting caused by lack of validation of analysis results ID in job configuration via REST API, letting attackers with Item/Configure permission execute arbitrary scripts.

  • 7.5 /10 High
    CVE-2026-92129 Auth required

    Jenkins Script Security Plugin - Sandbox Bypass

    Jenkins Script Security Plugin <= 1415.v9a_f9b_3a_c253d contains a sandbox bypass caused by unchecked calls to dynamically added methods in sandboxed scripts, letting attackers with script execution permission run code outside the sandbox.

  • 7.5 /10 High
    CVE-2026-92128 Auth required

    Jenkins Script Security Plugin - Remote Code Execution

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier contains a remote code execution caused by downloading a JAR file twice and loading classpath entries, letting attackers execute arbitrary code in Jenkins controller JVM, exploit requires attacker to define classpath entries.

  • 8.0 /10 High
    CVE-2026-92127 Auth required

    Jenkins Script Security Plugin - Remote Code Execution

    Jenkins Script Security Plugin <= 1415.v9a_f9b_3a_c253d contains a remote code execution caused by automatic approval of classpath entries when a user with Overall/Administer permission copies or updates item configuration, letting attackers execute arbitrary code in Jenkins controller JVM, exploit requires attacker to define classpath entries with admin permission.

  • 8.5 /10 High
    CVE-2026-92126 Auth required

    Jenkins Script Security Plugin - Remote Code Execution

    Jenkins Script Security Plugin <= 1415.v9a_f9b_3a_c253d contains a code execution vulnerability caused by improper rejection of @Builder annotations with arbitrary class names, letting attackers with script execution permission run code outside the sandbox if a suitable class is present on the classpath.

  • 8.8 /10 High
    CVE-2026-92125 Auth required

    Jenkins Script Security Plugin - Remote Code Execution

    Jenkins Script Security Plugin <= 1415.v9a_f9b_3a_c253d contains a code execution vulnerability caused by improper rejection of @GroovyASTTransformationClass annotation, letting attackers with script execution permission bypass sandbox and execute arbitrary code on the Jenkins controller JVM.

  • 8.8 /10 High
    CVE-2026-92124 Auth required

    Jenkins Script Security Plugin - Authentication Bypass

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier contains a sandbox bypass caused by improper type casting on collections in Groovy scripts, letting attackers with script execution permission run arbitrary code on the Jenkins controller JVM, exploit requires permission to define and run sandboxed scripts.

  • 8.8 /10 High
    CVE-2026-92123 Auth required

    Jenkins Script Security Plugin - Sandbox Bypass

    Jenkins Script Security Plugin <= 1415.v9a_f9b_3a_c253d contains a sandbox bypass caused by lack of interception on null receiver operations, letting attackers with script execution permission run arbitrary code on the Jenkins controller JVM, exploit requires permission to define and run sandboxed scripts.