High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 467 of 552

  • 7.3 /10 High
    CVE-2026-90566 No auth

    Rizwan17 inventory-management-system - Authorization Bypass

    Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f contains an authorization bypass caused by manipulation of the "usertype" argument in createUserAccount function of register.php, letting remote attackers gain improper authorization, exploit requires crafted request.

  • 8.1 /10 High
    CVE-2026-90562 No auth

    LangBot - Authentication Bypass

    LangBot < 4.10.11 contains a broken authentication caused by weak password recovery keys with 24 bits entropy and no rate limiting on reset-password endpoint, letting remote attackers exhaust keyspace and gain admin access, exploit requires knowing admin email.

  • 8.7 /10 High
    CVE-2026-90561 Auth required

    Strapi - Stored XSS

    Strapi 4.x < 4.26.3 and 5.x < 5.48.1 contain a stored XSS caused by failure to strip script tags in content manager WYSIWYG preview, letting Author-role users execute scripts in Editor or Super Admin sessions, exploit requires Author-role access.

  • 7.3 /10 High
    CVE-2026-90526 No auth

    SourceCodester School Registration and Fee System - SQL Injection

    SourceCodester School Registration and Fee System 1.0 contains a SQL injection caused by manipulation of the "Category" argument in /bilal/save_class.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-90524 No auth

    jaychouchannel Tourism-Management-System - Authentication Bypass

    jaychouchannel Tourism-Management-System contains an authentication bypass caused by manipulation in Update Endpoint, letting remote attackers bypass authentication, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-90523 No auth

    jaychouchannel Tourism-Management-System - Broken Access Control

    jaychouchannel Tourism-Management-System contains an improper privilege management vulnerability caused by manipulation of the UsersEntity argument in User Register Endpoint, letting remote attackers escalate privileges, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-90522 No auth

    jaychouchannel Tourism-Management-System - Authentication Bypass

    jaychouchannel Tourism-Management-System contains a broken authentication caused by weak password recovery in resetPass function of UsersController.java, letting remote attackers bypass password recovery, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-90516 No auth

    SourceCodester School Registration and Fee System - SQL Injection

    SourceCodester School Registration and Fee System 1.0 contains a SQL injection caused by manipulation of the "period" argument in /bilal/normal/pay_report.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-90515 No auth

    SourceCodester School Registration and Fee System - SQL Injection

    SourceCodester School Registration and Fee System 1.0 contains a SQL injection caused by manipulation of the argument selector[] in /bilal/normal/delete_stud.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-90514 No auth

    SourceCodester School Registration and Fee System - SQL Injection

    SourceCodester School Registration and Fee System 1.0 contains a sql injection caused by manipulation of the "Status" argument in /bilal/normal/save_stud.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 8.3 /10 High
    CVE-2026-90510 No auth

    Dromara Orion-Visor - Weak Cryptography

    Dromara Orion-Visor <= 2.5.7 contains a weak cryptography vulnerability caused by use of hard-coded cryptographic key in HostKeyServiceImpl.encryptKey, letting remote attackers compromise cryptographic security, exploit requires network access.

  • 7.3 /10 High
    CVE-2026-90509 No auth

    dromara orion-visor - Hardcoded Credentials

    dromara orion-visor <= 2.5.7 contains a hardcoded credentials vulnerability caused by manipulation in ExposeApiAspect.beforeExposeApi, letting remote attackers access hardcoded credentials, exploit requires remote access.

  • 7.3 /10 High
    CVE-2026-90504 No auth

    vvbbnn00 WARP-Clash-API - Authentication Bypass

    vvbbnn00 WARP-Clash-API contains an authentication bypass caused by manipulation of the SECRET_KEY argument in the authorized function, letting remote attackers bypass authentication, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90498 No auth

    Lenve vhr - Authentication Bypass

    Lenve vhr 1.0-SNAPSHOT contains a broken authentication caused by use of default credentials in vhr.sql, letting remote attackers gain unauthorized access, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90495 No auth

    Fengoffice Feng Office - SQL Injection

    Fengoffice Feng Office <= 3.11.13.11 contains a SQL injection caused by manipulation of the "auth" argument in Contacts::instance->findAll function of Legacy API, letting remote attackers execute arbitrary SQL queries, exploit requires no special privileges.