High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 500 of 552
- 7.5 /10 HighCVE-2026-45768 No auth
Suricata - Denial of Service
Suricata 8.0.0 to < 8.0.5 contains a denial of service caused by unbounded LDAP transaction state storing excessive responses, letting attackers cause memory exhaustion via crafted UDP LDAP traffic, exploit requires crafted network traffic.
- 7.5 /10 HighCVE-2026-45766 No auth
Suricata - Denial of Service
Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by insufficiently bounded NFS parser state structures, letting remote attackers cause excessive memory consumption, exploit requires crafted NFS traffic.
- 7.5 /10 HighCVE-2026-45765 No auth
Suricata - Denial of Service
Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by insufficient parser-level bounds in DNP3 reassembly, letting attackers cause excessive memory consumption remotely, exploit requires crafted DNP3 traffic.
- 7.5 /10 HighCVE-2026-45762 No auth
Suricata - Denial of Service
Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by improper IP defragmentation tracker lookup allowing IPv6 fragments to be associated with IPv4 trackers, letting remote attackers crash the system via crafted fragmented packets, exploit requires crafted fragmented IPv4/IPv6 traffic.
- 7.5 /10 HighCVE-2026-45759 No auth
Suricata - Denial of Service
Suricata < 7.0.16 and < 8.0.5 contains a denial of service caused by expensive parsing of large HTTP Content-Disposition headers during HTTP response processing, letting attackers cause excessive CPU usage remotely, exploit requires crafted HTTP traffic.
- 7.5 /10 HighCVE-2026-45747 PoC publicNo auth
Suricata - Denial of Service
Suricata < 7.0.16 contains a denial of service caused by dereferencing NULL certificate fields in Lua TLS certificate information helper, letting attackers crash the system by sending crafted TLS traffic, exploit requires Lua scripting on untrusted traffic.
- 8.0 /10 HighCVE-2026-42807 No auth
BoschSensortec COINES_SDK - Buffer Overflow
BoschSensortec COINES_SDK 2.10 through 2.12.2 contains a heap-based buffer overflow caused by unvalidated packet length in the PC bridge protocol decoder, letting attackers cause denial of service or execute arbitrary code via malicious USB or BLE payloads.
- 8.4 /10 HighCVE-2026-42805 No auth
Bosch Sensortec BHI385 SensorAPI - Buffer Overflow
Bosch Sensortec BHI385 SensorAPI contains a stack-based buffer overflow caused by lack of bounds checking on message length in debug message parser, letting attackers cause DoS or execute arbitrary code via crafted sensor payload.
- 7.6 /10 HighCVE-2026-42804
Bosch Sensortec BHI360 SensorAPI - Buffer Overflow
Bosch Sensortec BHI360 SensorAPI (C-Library) up to commit d6b200416a contains a stack-based buffer overflow caused by unchecked memcpy of debug frame payload in bhi360_parse_debug_message(), letting locally or physically positioned attackers execute arbitrary code or cause denial of service via crafted debug frames.
- 7.1 /10 HighCVE-2026-4130 Auth required
NI SystemLink - Information Disclosure
NI SystemLink and NI SystemLink Server <= 2026 Q3 contain a sensitive information disclosure caused by storage of sensitive data in cleartext, letting local attackers obtain sensitive information, exploit requires local access.
- 8.1 /10 HighCVE-2026-4129 Auth required
NI SystemLink - Broken Access Control
NI SystemLink and NI SystemLink Server <= 2026 Q3 contain an improper access control vulnerability caused by insufficient restrictions on host OS files and directories, letting authenticated users with limited privileges access restricted files.
- 7.8 /10 HighCVE-2026-2310 Auth required
IBM webMethods Integration Server - XML External Entity Injection
IBM webMethods Integration Server 11.1 contains an XML external entity injection caused by improper processing of XML data, letting remote attackers expose sensitive information or cause memory resource consumption, exploit requires crafted XML input.
- 7.7 /10 HighCVE-2026-19584 Auth required
Velociraptor - Server-Side Template Injection
Velociraptor contains a server-side template injection caused by interpolation of notebook cell content without ACL checks during backup restoration, letting users with NOTEBOOK_EDITOR permission execute elevated VQL queries, exploit requires NOTEBOOK_EDITOR permission.
- 7.5 /10 HighCVE-2026-19439 No auth
Ultimate Gift Cards for WooCommerce - Broken Access Control
Ultimate Gift Cards for WooCommerce WordPress plugin < 3.2.10 contains a broken access control vulnerability caused by lack of authorization checks when displaying gift card details, letting unauthenticated users disclose customer data and gift card information, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-19436 No auth
Ultimate Gift Cards for WooCommerce - Broken Access Control
Ultimate Gift Cards for WooCommerce WordPress plugin < 3.2.10 contains a broken access control vulnerability caused by lack of reconciliation between gift card coupon value and actual checkout amount, letting unauthenticated users obtain excess store credit, exploit requires no authentication.