High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 40 of 725

  • 7.5 /10 High
    CVE-2026-107039 No auth

    M66B/Marcel Bokhorst NetGuard no-root firewall - Denial of Service

    M66B/Marcel Bokhorst NetGuard no-root firewall 2.337 contains insecure permissions in ActivityMain component, letting unauthorized attackers cause device reset or denial of service, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-107037 No auth

    NoNonsense Notes - Broken Access Control

    NoNonsense Notes versionCode 72600 contains a broken access control caused by insecure permissions in NotificationHelper component, letting unauthorized attackers write to other users' notes via supplied note ID, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-107026 No auth

    Share to Clipboard - Broken Access Control

    Share to Clipboard v1.14.1 (versionCode 32) contains insecure permissions caused by improper access control, letting unauthorized attackers overwrite another user's clipboard content, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-107020 No auth

    FeedEx Handy News Reader - Open Redirect

    FeedEx Handy News Reader versionCode 116 contains an open redirect caused by crafted URL handling in activity.LoadLinkLaterActivity, letting attackers force victim users to fetch malicious URLs, exploit requires victim interaction.

  • 8.8 /10 High
    CVE-2026-104328 Auth required

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.12.3 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-104324 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.3 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote authenticated attackers execute arbitrary code.

  • 8.1 /10 High
    CVE-2026-104317 No auth

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.3 contains an insecure deserialization vulnerability caused by deserialization of untrusted data in the message broker, letting remote attackers execute arbitrary code, exploit requires network access to message broker.

  • 7.8 /10 High
    CVE-2026-103665 No auth

    Yamaha LAN Monitor - Remote Code Execution & Privilege Escalation

    Yamaha LAN Monitor for Windows contains a DLL hijacking vulnerability caused by insecure loading of DLLs during installation, letting attackers execute arbitrary code with administrative privileges when a crafted DLL is present.

  • 7.1 /10 High
    CVE-2026-103094

    ServiceNow AI Platform - Information Disclosure

    ServiceNow AI Platform contains an information disclosure vulnerability caused by unintended persistence of plaintext passwords in system tables, letting unauthorized users access sensitive credentials, exploit requires access to system tables.

  • 8.5 /10 High
    CVE-2026-103092 Auth required

    IBM Langflow OSS - SQL Injection

    IBM Langflow OSS 1.0.0 through 1.12.3 contains a SQL injection caused by improper access control, letting remote authenticated attackers execute arbitrary SQL commands.

  • 8.8 /10 High
    CVE-2026-101288 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.3 contains a remote code execution caused by improper neutralization of special elements in code, letting remote authenticated attackers execute arbitrary code.

  • 8.7 /10 High
    CVE-2025-62841 No auth

    HBS 3 Hybrid Backup Sync - Hardcoded Credentials

    HBS 3 Hybrid Backup Sync and Hybrid Backup Sync contain a hardcoded cryptographic key vulnerability caused by embedded static keys, letting remote attackers compromise system security, exploit requires no special conditions.

  • 8.7 /10 High
    CVE-2025-62839 No auth

    HBS 3 Hybrid Backup Sync - Hardcoded Credentials

    HBS 3 Hybrid Backup Sync and Hybrid Backup Sync contain a hardcoded cryptographic key vulnerability caused by embedded static keys, letting remote attackers compromise system security, exploit requires no special conditions.

  • 8.6 /10 High
    CVE-2023-7357 Auth required

    FlexNet Publisher - Remote Code Execution

    FlexNet Publisher lmadmin web user interface contains a remote code execution caused by unspecified vulnerability, letting remote attackers execute arbitrary code, exploit requires network access.

  • 7.5 /10 High
    CVE-2019-25781 No auth

    Python-Markdown - Denial of Service

    Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability caused by inefficient inline link parsing with unmatched brackets, letting remote attackers exhaust CPU resources, exploit requires crafted Markdown input.