High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 443 of 556

  • 7.2 /10 High
    CVE-2026-76869 Auth required

    Netcore NR255-V - Buffer Overflow

    Netcore NR255-V 1.5.130703 contains a buffer overflow caused by improper sscanf token parsing in reboot_timer_set.cgi, letting attackers corrupt stack memory by submitting crafted input.

  • 7.2 /10 High
    CVE-2026-76866 Auth required

    Netcore NR255-V - Command Injection

    Netcore NR255-V firmware 1.5.130703 contains a command injection caused by unquoted user-supplied DDNS input in DDNSset_cgi.c and ddns_Proc.c, letting attackers execute root-run commands, exploit requires crafted DDNS input.

  • 8.8 /10 High
    CVE-2026-76862 Auth required

    Netcore NR255-V - Command Injection

    Netcore NR255-V 1.5.130703 contains a command injection caused by injection of crafted arguments in tcpdump launch paths, letting attackers execute arbitrary system commands remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-76861 Auth required

    Netcore NR255-V - Buffer Overflow

    Netcore NR255-V 1.5.130703 contains a stack-based buffer overflow caused by an unsized sprintf call in ntools_tcpdump_start_set.cgi, letting attackers execute arbitrary code remotely, exploit requires crafted input to the CGI endpoint.

  • 8.8 /10 High
    CVE-2026-76860 Auth required

    Netcore NR255-V - Buffer Overflow

    Netcore NR255-V 1.5.130703 contains a stack-based buffer overflow caused by unbounded tokenization of MAC and ID input in wake_up_set.cgi, letting attackers corrupt program memory remotely, exploit requires crafted MAC and ID values.

  • 8.1 /10 High
    CVE-2026-76856 No auth

    Netcore NR255-V - Cross-Site Request Forgery

    Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery caused by lack of proper request validation in wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints, letting attackers trick authenticated administrators into modifying WAN or LAN network configurations without consent, exploit requires administrator authentication.

  • 8.1 /10 High
    CVE-2026-76853 Auth required

    Netcore NR268 - Authentication Bypass

    Netcore NR268 firmware version 1.7.121109 contains a security check bypass caused by flawed prefix validation in parame_put_file.cgi restore archive, letting attackers bypass restricted restore archive handling, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-76852

    Netcore NR268 - Authentication Bypass

    Netcore NR268 firmware version 1.7.121109 contains an authentication bypass caused by improper integrity verification in mtd_write, letting attackers bypass firmware signature validation and load unauthorized firmware images, exploit requires access to put_file.cgi and check_image_uuid.c.

  • 7.7 /10 High
    CVE-2026-76820 Auth required

    OpenCTI - Server Side Request Forgery

    OpenCTI prior to 7.260701.0 contains a server-side request forgery caused by insufficient validation of remote stream URLs in synchronizerFetch GraphQL query, letting authenticated users with INGESTION capability scan internal networks and access internal data.

  • 7.0 /10 High
    CVE-2026-76693 No auth

    HPE Networking EdgeConnect SD-WAN Gateways - Denial of Service

    HPE Networking EdgeConnect SD-WAN Gateways contain a denial-of-service vulnerability allowing unauthenticated remote attackers to disrupt certain services, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-76692

    HPE Networking EdgeConnect SD-WAN Gateways - Information Disclosure & Denial of Service

    HPE Networking EdgeConnect SD-WAN Gateways contain an information disclosure and denial of service vulnerability caused by uninitialized stack memory access, letting unauthenticated adjacent attackers disrupt service or obtain memory information, exploit requires network adjacency.

  • 7.2 /10 High
    CVE-2026-76691 Auth required

    HPE Networking EdgeConnect SD-WAN Gateways - Buffer Overflow

    HPE Networking EdgeConnect SD-WAN Gateways contain a buffer overflow caused by improper input handling in the API endpoint, letting authenticated remote attackers execute arbitrary commands as privileged users, exploit requires authentication.

  • 7.2 /10 High
    CVE-2026-76690 Auth required

    HPE Networking EdgeConnect SD-WAN Gateways - Command Injection

    HPE Networking EdgeConnect SD-WAN Gateways contain a command injection caused by specially crafted input in an authenticated component, letting authenticated remote attackers execute arbitrary commands as root.

  • 7.2 /10 High
    CVE-2026-76689 Auth required

    Affected component - Buffer Overflow

    Affected component contains a stack-based buffer overflow caused by improper processing of malformed configuration input, letting authenticated remote attackers with admin privileges execute remote code or cause denial of service.

  • 7.5 /10 High
    CVE-2026-76688 No auth

    EdgeConnect SD-WAN Orchestrator - Authentication Bypass

    EdgeConnect SD-WAN Orchestrator contains an authentication bypass vulnerability in its web-based management interface, letting unauthenticated remote attackers gain administrative privileges, exploit requires no authentication.