High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 482 of 552
- 8.8 /10 HighCVE-2026-89177 No auth
Howyar Technologies WeenyGenius - Use of Insecure Protocol
Howyar Technologies WeenyGenius contains a use of insecure protocol caused by reliance on ZMTP Null mode, letting unauthenticated attackers on the same network capture packets or perform replay attacks, exploit requires network access.
- 8.8 /10 HighCVE-2026-89176 No auth
Howyar Technologies WeenyGenius - Authentication Bypass
Howyar Technologies WeenyGenius contains a missing authentication vulnerability allowing unauthenticated attackers on the same network to spoof student or teacher endpoints, letting attackers disrupt classroom operations or gain remote control, exploit requires network access.
- 7.5 /10 HighCVE-2026-89174 No auth
Kingdom Communication Associated Smart Video Intercom System - Authentication Bypass
Kingdom Communication Associated Smart Video Intercom System contains a missing brute-force protection vulnerability, letting unauthenticated remote attackers gain access to valid accounts through numerous login attempts, exploit requires no special privileges.
- 7.4 /10 HighCVE-2026-89161 No auth
PCRE2 - Use After Free
PCRE2 < 10.48 contains a use after free caused by mishandling a previously copied subject passed as context in pcre2_jit_match, letting attackers cause memory corruption, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-89147
Net-SNMP - Denial of Service
Net-SNMP through 5.9.5.2 contains a denial of service caused by unauthenticated blocking read without timeout in the SMUX module's smux_accept(), letting unauthenticated remote clients block SNMP processing indefinitely, exploit requires network access to SMUX listener.
- 7.5 /10 HighCVE-2026-89146
libp2p-rendezvous - Denial of Service
libp2p-rendezvous <= 0.17.1 contains a denial of service caused by failure to validate registration TTL values in discovery responses, letting malicious rendezvous servers trigger timer arithmetic overflow and crash client nodes, exploit requires interaction with a malicious server.
- 7.5 /10 HighCVE-2026-89099 Auth required
MongoDB Server - Race Condition
MongoDB Server contains a race condition caused by unsynchronized concurrent operations on internal memory in the document value layer, letting authenticated users with read-write privileges cause memory corruption and server termination, exploit requires authenticated user with read-write access.
- 7.8 /10 HighCVE-2026-89066
projen - Command Injection
projen < 0.103.0 contains a command injection caused by improper neutralization of shell metacharacters in project configuration and repository file names in task synthesis, letting attackers execute arbitrary OS commands, exploit requires crafted project configuration or repository files.
- 7.1 /10 HighCVE-2026-89065
projen - Path Traversal
projen < 0.101.37 contains a path traversal caused by crafted entries in the generated file manifest cleanup component, letting context-dependent attackers recursively delete writable files outside the project directory, exploit requires writable environment.
- 7.7 /10 HighCVE-2026-89060
multicluster-observability-addon - Broken Access Control
multicluster-observability-addon contains a broken access control vulnerability caused by managed-cluster identity referencing configuration resources outside its namespace, letting attacker-controlled managed clusters disclose sensitive hub Secrets, exploit requires attacker-controlled managed cluster.
- 7.5 /10 HighCVE-2026-89013 CISA KEVPoC publicNo auth
Dolibarr - Authorization Bypass
Dolibarr < 24.0.1 contains an authorization bypass caused by crafted 'hashp' parameter in document storage endpoints, letting unauthenticated attackers read arbitrary files including logs and backups, exploit requires crafted 'hashp' parameter.
- 7.5 /10 HighCVE-2026-87908 No auth
multiparty - Denial of Service
multiparty 2.1.0 < 4.3.1 contains a denial of service caused by unbounded memory usage while accumulating multipart part headers, letting unauthenticated attackers crash the server by sending large header volumes, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-87776 No auth
compression Node.js - Denial of Service
compression Node.js middleware < 1.8.2 contains a denial of service caused by unreleased zlib streams on client connection abort, letting remote unauthenticated attackers exhaust memory and crash the server, exploit requires repeated early disconnects.
- 8.1 /10 HighCVE-2026-87020 Auth required
Orthanc DICOM Server - Integer Overflow
Orthanc DICOM Server contains an integer overflow caused by improper pitch and buffer-size computation during PNG decoding, letting attackers cause heap out-of-bounds write, exploit requires crafted PNG input.
- 8.8 /10 HighCVE-2026-85677 No auth
Gutenverse News WordPress - Stored XSS
Gutenverse News WordPress plugin < 3.3.3 contains a stored XSS caused by improper restriction of extra HTML in sanitisation contexts, letting unauthenticated users execute JavaScript in admin and visitor browsers, exploit requires unauthenticated comment submission.