High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 407 of 556

  • 7.4 /10 High
    CVE-2026-91853 Auth required

    TOTOLINK X5000R - Command Injection

    TOTOLINK X5000R 9.1.0cu.2089_B20211224 contains a command injection caused by manipulation of the "filetype" argument in exportOvpn function of /cgi-bin/cstecgi.cgi, letting remote attackers execute OS commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-91848 No auth

    WuzhiCMS - SQL Injection

    WuzhiCMS <= 4.1.0 contains a SQL injection caused by manipulation of the "title" and "master_table" arguments in article::getDataOfJson function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-91771

    Weights & Biases wandb - Path Traversal

    Weights & Biases wandb < 0.29.0 contains a path traversal caused by improper validation of file names in File.download function, letting attackers controlling the backend write files outside intended directories, exploit requires attacker control of backend.

  • 7.5 /10 High
    CVE-2026-91752 No auth

    GNU libextractor - Buffer Overflow

    GNU libextractor < 1.15 contains a buffer overflow caused by sizing a variable-length stack array from attacker-controlled OLE2 stream data in process_star_office, letting attackers cause application crashes, exploit requires crafted malicious StarOffice documents.

  • 8.3 /10 High
    CVE-2026-91751 Auth required

    Flextype CMS - Path Traversal

    Flextype CMS through 1.0.0-alpha.3 contains a path traversal caused by improper validation of id and new_id parameters in the Entries REST API, letting API token holders read, create, or overwrite arbitrary files outside the entries directory, exploit requires API token.

  • 8.3 /10 High
    CVE-2026-91748 No auth

    Google Chrome - Race Condition

    Google Chrome on Mac < 153.0.8010.47 contains a race condition in Extensions, letting remote attackers who compromised the renderer process and used social engineering execute arbitrary code outside the sandbox via UI interaction.

  • 8.8 /10 High
    CVE-2026-91745 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.3 /10 High
    CVE-2026-91743

    Google Chrome - Race Condition

    Google Chrome < 153.0.8010.47 contains a race condition in Core, letting remote attackers who compromised the renderer process execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires compromised renderer process.

  • 8.8 /10 High
    CVE-2026-91741 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.47 contains a remote code execution caused by type confusion in CacheStorage, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires victim to load crafted page.

  • 8.8 /10 High
    CVE-2026-91737 PoC publicNo auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in PDF component, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-91736 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in DOM, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-91735

    Google Chrome - Authorization Bypass

    Google Chrome < 153.0.8010.47 contains an authorization bypass caused by incorrect authorization in WebUI, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML page.

  • 7.4 /10 High
    CVE-2026-91734 No auth

    Google Chrome - Authorization Bypass

    Google Chrome < 153.0.8010.47 contains an authorization bypass caused by incorrect authorization in Core, letting local attackers execute arbitrary code outside the sandbox via a local program.

  • 8.3 /10 High
    CVE-2026-91733 No auth

    Google Chrome - Information Disclosure

    Google Chrome < 153.0.8010.47 contains an information disclosure vulnerability caused by improper state validation in Skia, letting remote attackers with compromised renderer process read memory outside the sandbox via crafted HTML page.

  • 8.1 /10 High
    CVE-2026-91732 PoC public

    Google Chrome - Broken Access Control

    Google Chrome < 153.0.8010.47 contains a broken access control caused by missing authorization in AppManifest, letting remote attackers who compromised the renderer process bypass web origin policy via crafted HTML page, exploit requires renderer compromise and social engineering.