High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 499 of 552

  • 7.2 /10 High
    CVE-2026-73694 Auth required

    FileRun - OS Command Injection

    FileRun < 2026.3.0 contains an OS command injection caused by no-op redefinition of escapeshellcmd() in CLI.php, letting attackers execute arbitrary commands via crafted input, exploit requires superuser authentication.

  • 8.8 /10 High
    CVE-2026-73693 Auth required

    FileRun - Command Injection

    FileRun before 2026.3.0 contains a command injection caused by missing escapeshellarg() sanitization in the PhotoProofSheet handler, letting authenticated users with upload permission execute arbitrary OS commands via crafted filenames.

  • 7.5 /10 High
    CVE-2026-71647 No auth

    EGO-Planner-v2 - Denial of Service

    EGO-Planner-v2 <= 5c99a95880401e2599638d567abc0e240396cb42 contains a denial of service caused by improper handling in checkCollisionCallback, execFSMCallback, and planFromGlobalTraj functions in ego_replan_fsm.cpp, letting attackers cause service disruption remotely, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-71645 No auth

    Robotics-STAR-Lab RACER Tested - Denial of Service

    Robotics-STAR-Lab RACER Tested commit abcdef1234567890 contains a denial of service caused by an issue in the exploration state machine, letting attackers cause service disruption, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-71643 No auth

    ZJU-FAST-Lab EGO-Planner-v2 - Denial of Service

    ZJU-FAST-Lab EGO-Planner-v2 <= 5c99a95880401e2599638d567abc0e240396cb42 contains a denial of service caused by an issue in the EGOReplanFSM component, letting attackers cause service disruption, exploit requires no special conditions.

  • 8.3 /10 High
    CVE-2026-64838 Auth required

    ICEcoder - Path Traversal

    ICEcoder <= 8.1 contains a path traversal vulnerability caused by improper validation of the oldFileName parameter in file move and rename operations, letting authenticated users move files outside the document root into web-accessible directories, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-64837 Auth required

    ICEcoder - Command Injection

    ICEcoder through 8.1 contains a command injection caused by unescaped filesystem path in lib/properties.php, letting authenticated users execute arbitrary OS commands via directory names, exploit requires user authentication.

  • 8.8 /10 High
    CVE-2026-64836 Auth required

    ICEcoder - Path Traversal

    ICEcoder <= 8.1 contains a path traversal caused by a logic error in document-root confinement check in file-control endpoint, letting authenticated attackers read, write, or delete files outside document root.

  • 7.8 /10 High
    CVE-2026-63427 Auth required

    Lenovo Software Fix - Authentication Bypass

    Lenovo Software Fix contains an authentication bypass vulnerability that allows a local authenticated user to execute arbitrary code with elevated privileges, exploit requires local authenticated access.

  • 7.5 /10 High
    CVE-2026-6285 No auth

    Ankaref Innovation and Technology Inc. LIBRID/LIBREF - Authentication Bypass

    Ankaref Innovation and Technology Inc. LIBRID/LIBREF 2.01.0.2183 through 10092026 contains a weak password recovery mechanism caused by insecure password reset process, letting attackers exploit password recovery to gain unauthorized access, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-49363 No auth

    Apache Artemis - Information Disclosure

    Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0 contain an information disclosure vulnerability caused by unauthenticated CORE protocol SUBSCRIBE_TOPOLOGY requests, letting remote attackers discover cluster node details without authentication.

  • 7.5 /10 High
    CVE-2026-49362 No auth

    Apache Artemis - Broken Access Control

    Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0 contain an unauthorized broker state manipulation vulnerability caused by unauthenticated remote creation of arbitrary durable queues via the CORE protocol, letting unauthenticated attackers cause denial of service.

  • 7.5 /10 High
    CVE-2026-46387 No auth

    Suricata - Denial of Service

    Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by unbounded HTTP/2 decompression buffer growth, letting remote attackers exhaust memory via crafted compressed HTTP/2 DATA payloads, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-45770 No auth

    Suricata - Sandbox Bypass & Denial of Service

    Suricata >= 8.0.0 and < 8.0.5 contains a sandbox bypass and denial of service caused by excessive flow variable registration in Lua rules, letting attackers bypass Lua sandbox or crash Suricata, exploit requires loading a crafted Lua script/rule.

  • 7.5 /10 High
    CVE-2026-45769 No auth

    Suricata - Denial of Service

    Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by unbounded growth of IKEv2 parser state when storing client transforms, letting attackers cause excessive memory consumption via crafted UDP traffic, exploit requires repeated crafted UDP packets.