High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 448 of 556

  • 8.4 /10 High
    CVE-2026-58679 No auth

    gf_ta_test - Buffer Overflow

    gf_ta_test contains a heap buffer overflow caused by a logic error in gf_ta_test_set_config function, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-58678 Auth required

    Bootloader - Permission Bypass

    Bootloader contains a permission bypass caused by a logic error in the code, letting local attackers escalate privileges to System level, exploit requires System execution privileges.

  • 7.1 /10 High
    CVE-2026-58485 No auth

    mcp-searxng - Server Side Request Forgery

    mcp-searxng < 1.7.1 contains a server-side request forgery caused by insufficient hostname validation in web_url_read, letting unauthenticated network attackers read internal services and expose credentials, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-58483 No auth

    mcp-searxng - Denial of Service

    mcp-searxng < 1.7.1 contains a denial of service caused by missing Content-Length header bypassing content length checks in URL reading, letting unauthenticated HTTP clients cause unbounded memory and CPU use, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-58200 Auth required

    Payload Plugins - Broken Access Control

    Payload Plugins @jhb.software/payload-cloudinary-plugin 0.3.0 to <0.4.0 contains a broken access control caused by lack of key allowlist and policy checks in signature generation, letting authenticated Payload users perform unauthorized Cloudinary operations, exploit requires authenticated Payload user.

  • 8.6 /10 High
    CVE-2026-57586 No auth

    CodeRAG - Command Injection

    CodeRAG < 1.3.1 contains a command injection caused by executing attacker-controlled Gradle wrapper scripts without validating their content, letting attackers execute arbitrary code with victim's OS privileges, exploit requires indexing a malicious Gradle repository.

  • 8.8 /10 High
    CVE-2026-57137 Auth required

    PraisonAI - Command Injection

    PraisonAI 1.4.0 to 1.7.2 contains a command injection caused by passing executable tools to generateText() before onToolCall approval, letting attackers execute rejected commands or operations, exploit requires use of onToolCall approval callback.

  • 8.8 /10 High
    CVE-2026-57136 Auth required

    PraisonAI - Command Injection

    PraisonAI 1.2.3 to 1.7.2 contains a command injection caused by improper validation of only the first executable in commands, letting attackers execute arbitrary commands with PraisonAI process privileges, exploit requires command input.

  • 7.6 /10 High
    CVE-2026-57135 Auth required

    PraisonAI - Broken Access Control

    PraisonAI 1.2.3 to 1.7.2 contains a broken access control vulnerability caused by improper network isolation in SandboxExecutor's buildEnv() injecting invalid proxy variables, letting attackers bypass network isolation and access internal or external services.

  • 8.2 /10 High
    CVE-2026-57134 No auth

    PraisonAI - Authentication Bypass

    PraisonAI 1.5.1 to 1.7.2 contains a broken authentication caused by improper validation of Basic and OAuth policies in MCPSecurity.evaluatePolicy(), letting attackers with invalid credentials access protected MCP tools, exploit requires use of Basic or OAuth policies with non-empty Authorization header.

  • 8.8 /10 High
    CVE-2026-57133 Auth required

    PraisonAI - Command Injection

    PraisonAI 1.5.1 to 1.7.2 contains a command injection caused by improper validation of shell() helper in utility-tools.ts, letting attackers execute arbitrary commands with PraisonAI process privileges, exploit requires crafted command input.

  • 8.3 /10 High
    CVE-2026-57112

    PraisonAI praisonaiagents - DNS Rebinding

    PraisonAI praisonaiagents 0.6.0 to 1.6.59 and PraisonAI 3.10.0 to 4.6.59 contain a DNS rebinding vulnerability caused by lack of Host, Origin, or authentication enforcement in SseServerTransport on legacy /sse and /messages/ endpoints, letting malicious websites invoke registered tools with server user privileges, exploit requires reachable local or internal SSE server.

  • 7.8 /10 High
    CVE-2026-57014 Auth required

    phNxpNciHal_ext - Out of Bounds Write

    phNxpNciHal_ext.cc contains an out-of-bounds write caused by missing bounds check in phNxpNciHal_ext_process_nfc_init_rsp, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-57012 No auth

    Setup Wizard - Privilege Escalation

    Setup Wizard contains a privilege escalation caused by missing permission check in remote package install, letting remote attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.5 /10 High
    CVE-2026-57008 No auth

    Modem - Information Disclosure

    Modem contains an information disclosure caused by improper input validation, letting remote attackers disclose sensitive information without needing additional privileges or user interaction.