High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 456 of 556

  • 7.3 /10 High
    CVE-2026-90715 No auth

    marcobambini Gravity - Integer Overflow

    marcobambini Gravity <= 0.9.7 contains an integer overflow caused by improper handling in udp json-parser component in src/utils/gravity_json.c, letting remote attackers cause potential memory corruption, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-90710 No auth

    taisan tarzan-cms - Server-Side Request Forgery

    taisan tarzan-cms 1.0.0 contains a server-side request forgery caused by manipulation of the "httpUrl" argument in Theme Download Function, letting remote attackers make arbitrary server requests, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90708 No auth

    Yot CMS - SQL Injection

    Yot CMS <= 3.3.1 contains a SQL injection caused by manipulation of the yot3_user/yot3_pass arguments in the Login function of global.php Cookie Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 8.3 /10 High
    CVE-2026-90707 No auth

    Open5GS - Use After Free

    Open5GS <= 2.7.x contains a use after free vulnerability caused by manipulation of the discovery_option argument in amf_nnrf_try_old_amf_discovery_fallback function, letting remote attackers cause memory corruption, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-90701 No auth

    subhajitkhan online-clinic-management-system - SQL Injection

    subhajitkhan online-clinic-management-system contains a SQL injection caused by manipulation of the "searchtext" argument in listdoctor.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 8.3 /10 High
    CVE-2026-90691 No auth

    0x4m4 HexStrike AI - Path Traversal

    0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04 contains a path traversal caused by manipulation of the "filename" argument in FileOperationsManager of hexstrike_server.py API Files Endpoint, letting remote attackers access arbitrary files, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90690 No auth

    0x4m4 HexStrike AI - Command Injection

    0x4m4 HexStrike AI contains a command injection caused by manipulation of arguments in subprocess.Popen in hexstrike_server.py API Tools Endpoint, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-90689 Auth required

    Tenda W20E - Buffer Overflow

    Tenda W20E 15.11.0.61068_1546_841_CN_TDC contains a stack-based buffer overflow caused by manipulation of the argument webAuthWhiteUserIndex in formDelWebAuthWhiteUser, letting remote attackers cause memory corruption, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-90620 No auth

    0x4m4 HexStrike AI - Authentication Bypass

    0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04 contains an authentication bypass caused by missing authentication in API Command Endpoint, letting remote attackers bypass authentication, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-90619 No auth

    0x4m4 HexStrike AI - Command Injection

    0x4m4 HexStrike AI contains a command injection caused by manipulation of the "code/script" argument in hexstrike_server.py Execute Endpoint, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90618 No auth

    GH05TCREW PentestAgent - Command Injection

    GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2 contains a command injection caused by manipulation in LocalRuntime.execute_command in runtime/runtime.py, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-90617 No auth

    GH05TCREW PentestAgent - Command Injection

    GH05TCREW PentestAgent contains a command injection caused by manipulation in run_task function of MCP HTTP Server component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-89180 No auth

    Thinking Software Technology EFence - SQL Injection

    Thinking Software Technology EFence contains a sql injection caused by improper input sanitization, letting unauthenticated remote attackers inject arbitrary SQL commands to read database contents, exploit requires no special privileges.

  • 8.6 /10 High
    CVE-2026-89023 No auth

    ThemeAtelier Domain For Sale - Broken Access Control

    ThemeAtelier Domain For Sale plugin for WordPress < 3.5.2 contains a broken access control vulnerability in REST API endpoints, letting unauthenticated attackers access and manipulate protected resources, including offer records and bidder information.

  • 7.1 /10 High
    CVE-2026-8821 Auth required

    Mattermost - Broken Access Control

    Mattermost 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 contains a broken access control caused by failure to validate channel member-management permission during playbook run creation, letting authenticated channel members add arbitrary users to restricted channels via the run owner field, exploit requires authentication.