High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 492 of 552

  • 8.8 /10 High
    CVE-2026-88862 Auth required

    Capgo - Broken Access Control

    Capgo backend through 12.242.4 contains a broken access control vulnerability caused by improper validation of parent-child delegation in API key processing, letting authenticated apikey_manager keys escalate privileges by impersonating more privileged sibling keys, exploit requires authenticated apikey_manager API key.

  • 8.3 /10 High
    CVE-2026-88861 PoC publicAuth required

    Capgo - Authentication Bypass

    Capgo contains an authentication bypass caused by improper assurance level validation in Edge JWT middleware and RBAC authorization, letting attackers with only a victim's password perform privileged operations, exploit requires victim's password.

  • 7.5 /10 High
    CVE-2026-88290 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.14 (260903) contains a denial of service caused by unauthenticated clients declaring unbounded VLSVR frame lengths, letting remote attackers exhaust memory and resources, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-88289 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.14 (260903) contains a stack buffer overflow caused by improper validation of variable-length fields in VLSVR request handlers, letting unauthenticated remote attackers cause a denial of service by crashing the service.

  • 7.5 /10 High
    CVE-2026-88287 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.13 contains a buffer overflow caused by unbounded Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, letting remote attackers crash the discovery process.

  • 7.5 /10 High
    CVE-2026-88286 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.13 contains a denial of service vulnerability caused by improper management of PTZ connection state, letting unauthenticated remote clients block new PTZ connections, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-88282 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by administrator-controlled FTP username with shell metacharacters executed during FTP-account update, letting attackers execute arbitrary root commands, exploit requires administrator privileges.

  • 8.8 /10 High
    CVE-2026-88277 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by improper sanitization of ConsumerReference.Address in ONVIF interface, letting authenticated users execute arbitrary commands as root.

  • 7.2 /10 High
    CVE-2026-88276 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by administrator-controlled WEP key values containing shell syntax, letting attackers execute arbitrary commands as root, exploit requires administrator privileges.

  • 7.2 /10 High
    CVE-2026-88275 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by administrator-controlled WPA-PSK with shell syntax in wireless configuration, letting attackers execute arbitrary commands as root, exploit requires administrator privileges.

  • 7.2 /10 High
    CVE-2026-88274 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by administrator-controlled wireless SSID with shell syntax, letting attackers execute arbitrary commands as root, exploit requires administrator privileges.

  • 7.2 /10 High
    CVE-2026-88273 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by administrator-controlled PPPoE username escaping shell configuration, letting attackers execute arbitrary commands as root, exploit requires administrator privileges.

  • 7.2 /10 High
    CVE-2026-88272 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by administrator-controlled username with shell metacharacters executed as root commands during deletion, letting attackers execute arbitrary root commands, exploit requires administrator privileges.

  • 8.8 /10 High
    CVE-2026-88271 Auth required

    GeoVision GV-LPC2211 - Broken Access Control

    GeoVision GV-LPC2211 V1.13 contains a broken access control vulnerability caused by improper SSVR handling, letting guest users overwrite device configuration and replace the administrator password, exploit requires guest access.

  • 7.8 /10 High
    CVE-2026-88053 PoC publicAuth required

    Tesseract - Out of Bounds Read/Write

    Tesseract <= 5.5.3 contains a buffer overflow caused by unvalidated loop bounds from crafted .traineddata file in Classify::ReadIntTemplates, letting attackers cause heap corruption or crash during legacy-classifier initialization, exploit requires crafted .traineddata file.