High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 481 of 552

  • 7.8 /10 High
    CVE-2026-89441 Auth required

    Linux kernel mmc via-sdmmc - Use After Free

    Linux kernel mmc via-sdmmc contains a use-after-free vulnerability caused by card-detect work running after device removal, letting attackers cause memory corruption, exploit requires device removal triggering.

  • 7.8 /10 High
    CVE-2026-89440 Auth required

    Linux Kernel mmc via-sdmmc - Use After Free

    Linux kernel mmc via-sdmmc contains a use-after-free vulnerability caused by improper interrupt handling on probe failure, letting attackers cause kernel memory corruption, exploit requires triggering probe failure.

  • 7.8 /10 High
    CVE-2026-89436 Auth required

    Linux kernel panasonic-laptop - Out of Bounds Read/Write

    Linux kernel platform/x86 panasonic-laptop contains a buffer overflow caused by improper sentinel write past pcc->sinf[] array bounds, letting attackers cause heap overflow, exploit requires specific hardware with off-by-one DSDT SINF package count.

  • 7.5 /10 High
    CVE-2026-89262 No auth

    MoguBlog - Authorization Bypass

    MoguBlog <= 6.2 contains an authorization bypass caused by ownership checks against request-body fields instead of the authenticated principal in the comment deletion endpoint, letting attackers delete arbitrary comments and replies, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-89260 No auth

    MoguBlog - XML External Entity Injection

    MoguBlog through 6.2 contains an XML external entity injection caused by unhardened dom4j SAXReader usage in WeChat callback handler at POST /wechat/wechatCheck, letting unauthenticated remote attackers read local files or trigger outbound HTTP requests, exploit requires crafted XML with DOCTYPE declarations.

  • 8.7 /10 High
    CVE-2026-89256 Auth required

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by lack of encoding of chapter names in the Bookmark plugin, letting video owners inject scripts executed by every visitor on the public watch page, exploit requires video ownership.

  • 8.7 /10 High
    CVE-2026-89255 Auth required

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by failure to HTML-encode PGP public keys in LoginControl plugin textarea, letting authenticated attackers execute JavaScript in administrator sessions when viewing user profiles.

  • 8.7 /10 High
    CVE-2026-89254 Auth required

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by unsanitized field_name parameter in CustomizeUser plugin via add.json.php, letting administrators inject scripts that execute on extra info or profile pages, exploit requires admin privileges.

  • 8.7 /10 High
    CVE-2026-89253 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo contains a stored XSS caused by improper validation and encoding of the 'donationLink' user profile field, letting authenticated users inject JavaScript that executes in visitors' browsers, exploit requires user authentication.

  • 7.5 /10 High
    CVE-2026-89250 No auth

    WWBN AVideo - Unauthorized File Read

    WWBN AVideo contains an unauthenticated file read vulnerability caused by lack of authentication and authorization checks in getRecordedFile.php endpoint, letting attackers download recorded live video files using known or guessed stream keys.

  • 8.7 /10 High
    CVE-2026-89249 Auth required

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by base64-encoded but unescaped user-supplied CryptoWallet values in YPTWallet plugin, letting attackers execute scripts in admin sessions, exploit requires admin to view pending requests.

  • 8.1 /10 High
    CVE-2026-89243 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo contains a stored XSS caused by lack of sanitization in UserGroups::setGroup_name(), letting administrators with canAdminUserGroups permission inject malicious scripts executed by other administrators, exploit requires admin privileges.

  • 7.2 /10 High
    CVE-2026-89242 No auth

    WWBN AVideo - Server Side Request Forgery

    WWBN AVideo contains a server-side request forgery caused by lack of validation in the _json_decode function fetching remote URLs and local file paths, letting unauthenticated attackers read local files or access internal services via login.json.php.

  • 8.6 /10 High
    CVE-2026-89212 No auth

    Akana API Platform - XML External Entity Injection

    Akana API Platform <= 2026.1, 2025.1.1, and < 2024.1.6 contains an XML external entity injection caused by improper restriction of references during XML-to-JSON processing, letting attackers disclose sensitive information, exploit requires crafted XML input.

  • 8.8 /10 High
    CVE-2026-89178 No auth

    Howyar Technologies WeenyGenius - Origin Validation Error

    Howyar Technologies WeenyGenius contains an origin validation error vulnerability allowing unauthenticated attackers on the same network to spoof teacher workstations and send broadcast packets, causing student computers to connect to the attacker.