High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 455 of 556

  • 7.8 /10 High
    CVE-2026-90948 No auth

    GIMP - Remote Code Execution

    GIMP contains a heap-based buffer overflow caused by an integer overflow in ICO file loader during buffer size calculation for embedded PNG images, letting remote attackers execute arbitrary code or cause a crash, exploit requires opening a crafted ICO file.

  • 7.8 /10 High
    CVE-2026-90947 No auth

    GIMP - Remote Code Execution

    GIMP contains a buffer overflow caused by improper validation of the number of light sources in a specially crafted lighting preset file, letting attackers execute arbitrary code by convincing users to open malicious files.

  • 7.5 /10 High
    CVE-2026-90946 No auth

    DeepWiki-Open - Arbitrary File Read

    DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability caused by lack of path containment in the unauthenticated /ws/chat WebSocket endpoint, letting attackers read sensitive files, exploit requires no authentication.

  • 8.2 /10 High
    CVE-2026-90944 No auth

    Krayin CRM - Authentication Bypass

    Krayin CRM <= 2.2.6 contains an authentication bypass caused by unauthenticated access to the POST /admin/mail/inbound-parse endpoint, letting unauthenticated attackers inject arbitrary emails into the CRM inbox, exploit requires no authentication.

  • 8.7 /10 High
    CVE-2026-90943 Auth required

    Parallax filament-comments - Stored XSS

    Parallax filament-comments <= 3.0.0 contains a stored XSS caused by improper sanitization in comment body rendering, letting authenticated panel users inject malicious scripts that execute in other users' browsers.

  • 8.6 /10 High
    CVE-2026-90938 No auth

    LangBot langbot_plugin - Authentication Bypass

    LangBot langbot_plugin <= 0.4.17 contains an authentication bypass caused by default empty plugin_debug_key on debug WebSocket server, letting remote attackers register debug plugins and access sensitive IM events, exploit requires network access to port 5401.

  • 7.1 /10 High
    CVE-2026-90933 Auth required

    Laradashboard - Broken Access Control

    Laradashboard through 1.2.2 contains a broken access control vulnerability in Local License API endpoints, letting authenticated low-privileged users read, overwrite, and delete premium module license keys, exploit requires authentication.

  • 7.2 /10 High
    CVE-2026-90932 Auth required

    LaraDashboard - Path Traversal

    LaraDashboard 0.9.7 through 1.2.2 contain a path traversal vulnerability caused by improper validation of backup_file/filename in core-upgrade backup handling, letting authenticated users with delegated settings.edit permission delete or write arbitrary files, exploit requires delegated settings.edit permission.

  • 8.1 /10 High
    CVE-2026-90929 Auth required

    File Browser - Broken Access Control

    File Browser >= 2.5.0 and <= 2.63.23 contains an incorrect authorization flaw in the direct-upload endpoint caused by improper permission checks during cleanup, letting authenticated non-admin users delete unauthorized directories within their scope, exploit requires authenticated user with Create and Modify permissions.

  • 7.8 /10 High
    CVE-2026-90894 Auth required

    Parallels Desktop - Command Injection

    Parallels Desktop contains a command injection caused by improper handling of quoted folder names in PrlSrv_InstallAppliance, letting local attackers execute arbitrary commands as root via crafted appliance folder names, exploit requires local access.

  • 7.3 /10 High
    CVE-2026-90819 No auth

    a2aproject a2a-java - HTTP Response Splitting

    a2aproject a2a-java 1.2.0 contains an HTTP response splitting vulnerability caused by improper Authorization Header Construction in BasePushNotificationSender.dispatchNotification, letting remote attackers manipulate HTTP responses, exploit requires crafted requests.

  • 7.3 /10 High
    CVE-2026-90809 No auth

    HKUDS nanobot - Command Injection

    HKUDS nanobot <= 0.2.1 contains a command injection caused by improper handling in ExecTool._guard_command and ExecTool._spawn in nanobot/agent/tools/shell.py, letting remote attackers inject arguments, exploit requires remote access.

  • 7.3 /10 High
    CVE-2026-90805 No auth

    subhajitkhan online-clinic-management-system - SQL Injection

    subhajitkhan online-clinic-management-system contains a SQL injection caused by manipulation of the doc_mail/doc_pswd arguments in doctorlogin.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90789 No auth

    itsourcecode Leave Management System - SQL Injection

    itsourcecode Leave Management System 1.0 contains a sql injection caused by manipulation of the "user_email" argument in /login.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-90787 No auth

    Soarkey StudentManagement - Broken Access Control

    Soarkey StudentManagement contains an improper privilege management vulnerability caused by manipulation of the "level" argument in RegisterServlet.doPost of Registration Workflow, letting remote attackers escalate privileges, exploit requires crafted request.