High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 4 of 552

  • 7.5 /10 High
    CVE-2026-103896 No auth

    10Web Booster - Path Traversal

    10Web Booster WordPress plugin <= 2.34.5 contains a limited file write via path traversal caused by unsanitized $_GET parameters in cache path construction, letting unauthenticated attackers create arbitrary directories and poison cache, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-106708 No auth

    XXL-JOB - Cross-Site Request Forgery

    XXL-JOB <= 3.5.0-SNAPSHOT contains a cross-site request forgery caused by lack of CSRF protection and HTTP method restrictions in JobUserController endpoints /user/insert, /user/update, and /user/delete, letting attackers perform unauthorized actions, exploit requires victim user interaction.

  • 7.5 /10 High
    CVE-2026-87018 No auth

    undici - Denial of Service

    undici HTTP client library for Node.js versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 contains a denial of service caused by unhandled TLS 1.2 renegotiation with mismatched hostname certificates, letting attackers crash the client process, exploit requires attacker-controlled HTTPS endpoint.

  • 7.5 /10 High
    CVE-2026-109869 No auth

    undici - Denial of Service

    undici 6.23.0 to 6.29.0, 7.18.0 to 7.30.0, and 8.0.0 to 8.12.1 contain a denial of service caused by improper handling of responses with more than five content codings and premature connection close in fetch(), letting remote unauthenticated servers crash the Node.js process, exploit requires malicious server response.

  • 7.4 /10 High
    CVE-2026-109829 No auth

    undici - Cache Poisoning & Information Disclosure

    undici 7.0.0 to 7.30.0 and 8.0.0 to 8.12.1 contain a cache poisoning and information disclosure vulnerability caused by improper cache key handling after cross-origin redirects in originless Agent with shared cache, letting attackers poison cache or disclose private data, exploit requires use of originless Agent with shared cache and redirect-then-cache composition.

  • 7.4 /10 High
    CVE-2026-109383 No auth

    undici - Authentication Bypass

    undici 4.0.0 to 6.29.0, 7.0.0 to 7.30.0, and 8.0.0 to 8.12.1 contain a broken authentication caused by JSON-based deep cloning dropping custom checkServerIdentity callbacks in TLS options, letting attackers bypass custom TLS certificate verification, exploit requires passing a function-valued tls option.

  • 8.7 /10 High
    CVE-2026-109449 No auth

    Symfony Expression Language - Denial of Service

    Symfony Expression Language < 5.4.54, < 6.4.48, < 7.4.21, and < 8.1.9 contains a denial of service caused by unbounded expression tree depth in the parser, letting attackers crash the PHP process by submitting deeply nested expressions, exploit requires sending crafted expressions.

  • 7.4 /10 High
    CVE-2026-111280 No auth

    snap7 - Buffer Overflow

    snap7 through 1.4.3 contains a buffer overflow caused by unchecked DataLength field in TSnap7MicroClient::opReadArea(), letting malicious S7 peers crash processes and corrupt memory, exploit requires crafted ReadVar responses from rogue or impersonated PLCs.

  • 7.5 /10 High
    CVE-2026-104827 No auth

    ReactPHP react/http - Denial of Service

    ReactPHP react/http 1.0.0 to 1.11.1 contains a denial of service caused by unbounded response-header buffering in ClientRequestStream::handleData(), letting remote servers exhaust PHP memory and crash processes, exploit requires attacker-controlled URLs.

  • 8.2 /10 High
    CVE-2026-101307 No auth

    RACK stack - Out-of-Bounds Write

    The RACK stack contains an out-of-bounds write caused by repeated doubling of a 16-bit allocation counter that wraps to zero during PCM sample array expansion, letting remote attackers cause kernel panic by sending many ACKs on an established TCP connection.

  • 7.1 /10 High
    CVE-2026-53582 PoC publicAuth required

    OPNsense - XPath Injection

    OPNsense < 26.1.10 contains an XPath injection caused by interpolation of attacker-controlled certificate authority and certificate refid values in Trust module, letting users with CA or Certificate Manager privileges recover sensitive config.xml values, exploit requires CA Manager or Certificate Manager privileges.

  • 7.5 /10 High
    CVE-2026-100409 No auth

    OpenNext Cloudflare - Authorization Bypass

    OpenNext Cloudflare 0.3.0 to 1.20.2 contains an authorization bypass caused by inconsistent processing of encoded pathnames between middleware and cache lookup, letting unauthenticated attackers access cached protected content, exploit requires enabled cache interception and matching cached protected routes.

  • 7.7 /10 High
    CVE-2026-111312 No auth

    OpenHealth - Broken Access Control

    OpenHealth <= 0.2.0 contains a broken access control vulnerability caused by missing authentication and authorization checks in /api/health-data/[id] GET, PATCH, and DELETE handlers, letting unauthenticated attackers read, modify, or delete other users' medical records by knowing the record id, exploit requires knowledge of a valid HealthData record id.

  • 7.5 /10 High
    CVE-2026-111277 No auth

    NivoCart - Broken Access Control

    NivoCart <= 2.5.1 contains a broken access control vulnerability in the download() action of account/order, letting unauthenticated attackers retrieve guest order invoices and sensitive customer data by iterating order_id.

  • 8.8 /10 High
    CVE-2026-108451 No auth

    Microsoft Office Word - Remote Code Execution

    Microsoft Office Word contains a numeric truncation error allowing unauthorized attackers to execute code remotely, exploit requires network access.