High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 454 of 556

  • 8.4 /10 High
    CVE-2026-0194 No auth

    Affected product - Privilege Escalation

    Affected product contains a privilege escalation caused by an integer overflow in multiple locations, letting local attackers bypass permissions without additional execution privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-0189 No auth

    ac_init_policy - Permission Bypass

    ac_init_policy contains a permission bypass caused by a logic error in init.c, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-0171 Auth required

    Unknown - Out of Bounds Write

    Unknown product contains an out-of-bounds write caused by a logic error in multiple locations, letting remote attackers execute arbitrary code, exploit requires no special privileges or user interaction.

  • 8.8 /10 High
    CVE-2026-0170 Auth required

    Vp9DecodeFrameTag - Privilege Escalation

    Vp9DecodeFrameTag in vp9hwd_headers.cc contains an out-of-bounds write caused by missing bounds check, letting remote attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-0159 Auth required

    Cellular Modem - Remote Code Execution

    Cellular Modem contains an out-of-bounds write caused by a missing bounds check, letting remote attackers execute arbitrary code without additional privileges, exploit requires no user interaction.

  • 7.5 /10 High
    CVE-2025-66974 No auth

    Prolink 13A Smart Plug - Denial of Service & Connection Redirection

    Prolink 13A Smart Plug Model DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 contains a denial of service caused by crafted packets during provisioning, letting attackers cause DoS or redirect connections to attacker devices, exploit requires crafted packet during provisioning.

  • 7.5 /10 High
    CVE-2024-14029

    Tornado - HTTP Request Smuggling

    Tornado < 6.4.1 contains an HTTP request smuggling vulnerability caused by ignoring duplicate Transfer-Encoding: chunked headers, letting attackers perform request smuggling to bypass access control, poison cache, or desynchronize connections, exploit requires deployment behind proxies.

  • 7.5 /10 High
    CVE-2023-54397 No auth

    Tornado - HTTP Request Smuggling

    Tornado < 6.3.3 contains an HTTP request smuggling vulnerability caused by improper parsing of Content-Length headers accepting non-standard characters, letting attackers bypass proxy validation and smuggle requests, exploit requires deployment behind certain proxies.

  • 8.8 /10 High
    CVE-2026-91200 No auth

    DevSpace - Path Traversal & Remote Code Execution

    DevSpace <= 6.3.21 contains a path traversal vulnerability caused by failure to reject parent-directory segments in tar entry names from the in-pod sync stream, letting attackers operating malicious containers write arbitrary files and execute code on the developer workstation, exploit requires attacker to control a container.

  • 7.1 /10 High
    CVE-2026-91145 Auth required

    Activiti - Expression Language Injection

    Activiti <= 7.1.0.M6 contains an expression injection vulnerability caused by failure to validate hash-brace deferred expressions in process variables, letting attackers inject and execute expressions in mail task body fields, exploit requires crafted process variables.

  • 7.5 /10 High
    CVE-2026-91144 No auth

    ZFile - Broken Access Control

    ZFile <= 5.0.5 contains a broken access control caused by insufficient validation of file paths on the download endpoint, letting attackers with a share link download arbitrary files under the shared base directory, exploit requires attacker to have a valid share link.

  • 7.2 /10 High
    CVE-2026-91143 No auth

    goproxy - Broken Access Control

    goproxy through 15.3 contains a broken access control vulnerability caused by failure to apply HTTP proxy basic authentication to CONNECT tunnel requests, letting unauthenticated clients relay arbitrary TCP traffic and access restricted destinations, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-91080 No auth

    Webhook - Denial of Service

    Webhook <= 2.8.3 contains a denial of service caused by reading entire request bodies into memory before evaluating trigger rules, letting unauthenticated attackers exhaust memory and crash the service, exploit requires sending oversized request bodies.

  • 8.5 /10 High
    CVE-2026-91079 Auth required

    Huly Platform - Server-Side Request Forgery

    Huly Platform through 0.7.426 contains a server-side request forgery caused by missing hostname allowlist validation in the print service, letting authenticated workspace members access internal metadata services and network hosts by supplying arbitrary URLs.

  • 7.8 /10 High
    CVE-2026-90949 No auth

    GIMP - Buffer Overflow

    GIMP contains a heap-based buffer overflow caused by a size mismatch in the PSP file loader's compressed selection channel processing, letting remote attackers execute arbitrary code by opening a crafted PSP file.