High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 442 of 556

  • 8.5 /10 High
    CVE-2026-82993 Auth required

    Oracle PeopleSoft PeopleSoft Enterprise PeopleTools - Broken Access Control

    Oracle PeopleSoft PeopleSoft Enterprise PeopleTools 8.61-8.63 contains an unauthorized access vulnerability caused by insufficient access control in Business Interlink, letting low privileged attackers with network access via HTTP compromise data confidentiality and integrity, exploit requires low privileged network access.

  • 7.8 /10 High
    CVE-2026-82992 Auth required

    Oracle Siebel CRM Deployment - Privilege Escalation

    Oracle Siebel CRM Deployment 17.0-26.7 contains a privilege escalation caused by vulnerable installation component, letting low privileged logged-in attackers take over Siebel CRM Deployment.

  • 7.2 /10 High
    CVE-2026-81895 Auth required

    Concrete CMS - SQL Injection

    Concrete CMS before 9.5.3 contains a stored SQL injection caused by lack of integer validation and improper query concatenation in Document Library block's file-set identifiers, letting authenticated users with edit permissions execute arbitrary SQL, exploit requires authenticated user with block edit permissions.

  • 8.6 /10 High
    CVE-2026-81240 No auth

    Dell Wyse Management Suite - Unrestricted File Upload

    Dell Wyse Management Suite < 2605.0.3.683 contains an unrestricted file upload vulnerability caused by insufficient file type validation, letting unauthenticated remote attackers execute code remotely, exploit requires remote access.

  • 8.6 /10 High
    CVE-2026-81239 No auth

    Dell Wyse Management Suite - Remote Code Execution

    Dell Wyse Management Suite < 2605.0.3.683 contains an unrestricted file upload vulnerability caused by lack of file type restrictions, letting unauthenticated remote attackers execute code remotely, exploit requires remote access.

  • 7.5 /10 High
    CVE-2026-81238 No auth

    Dell Wyse Management Suite - Authentication Bypass

    Dell Wyse Management Suite < 2605.0.3.683 contains a missing authentication for critical function vulnerability, letting unauthenticated remote attackers gain unauthorized access, exploit requires remote access.

  • 8.6 /10 High
    CVE-2026-81236 No auth

    Dell Wyse Management Suite - Remote Code Execution

    Dell Wyse Management Suite < 2605.0.3.683 contains an unrestricted file upload vulnerability allowing unauthenticated remote attackers to execute arbitrary code remotely, exploit requires remote access.

  • 8.0 /10 High
    CVE-2026-81235 Auth required

    Dell Wyse Management Suite - Data Tampering

    Dell Wyse Management Suite < 2605.0.3.683 contains a missing cryptographic step vulnerability, letting high privileged remote attackers tamper with information, exploit requires high privileges and remote access.

  • 8.8 /10 High
    CVE-2026-80217 Auth required

    FF-RFI - Command Injection

    FF-RFI079I4 and FF-RFI078I4 contain a command injection caused by hidden functionality accessible via SSH enable mode, letting logged-in users execute arbitrary OS commands, exploit requires SSH login and enable mode access.

  • 7.5 /10 High
    CVE-2026-79551 PoC publicNo auth

    Tenda Technology Co., Ltd NVR_4H CH3 - Hardcoded Credentials

    Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 contains a hardcoded cryptographic key caused by embedded static keys in the software, letting attackers potentially decrypt or tamper with encrypted data, exploit requires no special conditions.

  • 8.1 /10 High
    CVE-2026-79425 Auth required

    CRMEB - Server Side Request Forgery

    CRMEB v6.0.0 contains an authenticated server side request forgery caused by improper validation in /adminapi/file/online_upload, letting authenticated attackers scan internal resources via crafted POST requests.

  • 8.8 /10 High
    CVE-2026-79411 Auth required

    Webkul Bagisto - Broken Access Control

    Webkul Bagisto 2.4.9 contains a broken access control vulnerability caused by improper privilege verification in the admin user-management component, letting authenticated backend users escalate to full administrator by modifying their own role via the user-update endpoint.

  • 8.1 /10 High
    CVE-2026-79410 Auth required

    Webkul Bagisto - Broken Access Control

    Webkul Bagisto v2.4.9 contains a broken access control caused by improper validation of the quantity parameter in the add-to-cart path, letting authenticated attackers reduce order total below legitimate price.

  • 8.8 /10 High
    CVE-2026-77853 Auth required

    FF-RFI - OS Command Injection

    FF-RFI079I4 and FF-RFI078I4 contain an OS command injection caused by improper neutralization of special elements in M-Plane (NETCONF), letting logged-in users execute arbitrary OS commands.

  • 7.1 /10 High
    CVE-2026-76870 Auth required

    Netcore NR255-V - Out of Bounds Read

    Netcore NR255-V 1.5.130703 contains an out-of-bounds read vulnerability caused by short firmware uploads in the mtd_write pre-flash validation routine, letting attackers trigger out-of-bounds reads via truncated firmware upload.