High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 460 of 556

  • 7.2 /10 High
    CVE-2026-82793 Auth required

    Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit - Unrestricted File Upload

    Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit contains an unrestricted file upload vulnerability caused by lack of file type restrictions, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-82791 Auth required

    Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit - OS Command Injection

    Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit contains an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.8 /10 High
    CVE-2026-82789 Auth required

    CONPROSYS HMI System - Expression Language Injection

    CONPROSYS HMI System contains an expression language injection caused by improper neutralization of directives in dynamically evaluated code, letting logged-in attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-82780 Auth required

    CONPROSYS TM Series - Unrestricted File Upload

    CONPROSYS TM Series contains an unrestricted file upload vulnerability caused by lack of file type restrictions, letting remote authenticated attackers execute arbitrary commands, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-82779 Auth required

    CONPROSYS TM Series - Command Injection

    CONPROSYS TM Series contains an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.8 /10 High
    CVE-2026-82777 Auth required

    CONPROSYS PAC Series - OS Command Injection

    CONPROSYS PAC Series contains an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.8 /10 High
    CVE-2026-82774 Auth required

    CONPROSYS M2M Gateway & Controller Series - OS Command Injection

    CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series contain an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.8 /10 High
    CVE-2026-82772 Auth required

    Contec EC1000 - Buffer Overflow

    Contec EC1000 series contains a buffer overflow caused by improper handling of specially crafted requests in the web service, letting remote attackers execute arbitrary programs remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-82770 Auth required

    Contec RP-WAH-SR Series - Buffer Overflow

    Contec RP-WAH-SR Series contains a buffer overflow caused by improper handling of specially crafted requests in the web service, letting remote attackers execute arbitrary programs, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-82768 Auth required

    SGA1000 - Path Traversal

    SGA1000 contains a path traversal vulnerability that allows attackers with FTP access to view or modify arbitrary files on the server, exploit requires FTP access.

  • 8.8 /10 High
    CVE-2026-82766 Auth required

    SGA1000 - OS Command Injection

    SGA1000 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.1 /10 High
    CVE-2026-82765 Auth required

    Contec FX Series - Path Traversal

    Contec FX5000, FX4000, and FX3000 series contain a path traversal vulnerability caused by improper input validation in FTP access, letting attackers view or alter arbitrary files on the server, exploit requires FTP access.

  • 8.8 /10 High
    CVE-2026-82762 Auth required

    Contec FX Series - OS Command Injection

    Contec FX5000, FX4000, and FX3000 series contain an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.1 /10 High
    CVE-2026-82438 Auth required

    Apache Storm - Broken Access Control

    Apache Storm < 3.1.0 contains a broken access control caused by improper CORS and JSONP handling in HTTP components, letting authenticated users' web pages on unrelated origins read sensitive cluster and log data, exploit requires authenticated user interaction.

  • 8.1 /10 High
    CVE-2026-82432

    Apache Nimbus - Broken Access Control

    Apache Nimbus < 3.1.0 contains an authorization bypass caused by insufficient validation of topology.blobstore.map and lack of authorization in listBlobs, letting attackers with rebalance rights or network access disclose blob metadata and introduce unauthorized blobstore entries, exploit requires rebalance privileges or network access to Nimbus Thrift port.