High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 507 of 552

  • 7.0 /10 High
    CVE-2026-87088 No auth

    Tanium Enforce - Remote Code Execution

    Tanium Enforce contains an unauthorized code execution vulnerability caused by improper access control, letting attackers execute code without authorization, exploit requires no special conditions.

  • 7.7 /10 High
    CVE-2026-87084 Auth required

    Tanium Enforce - Server Side Request Forgery

    Tanium Enforce contains a server-side request forgery caused by improper validation of URLs, letting attackers make arbitrary requests from the server, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-87075 Auth required

    Tanium Comply - Broken Access Control

    Tanium Comply contains an improper access control vulnerability caused by insufficient access restrictions, letting attackers access unauthorized resources, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-87072 Auth required

    Tanium Comply - Broken Access Control

    Tanium Comply contains an improper access control vulnerability caused by insufficient access restrictions, letting attackers access unauthorized resources, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-87036

    CVE-2026-87036

    Tanium addressed an improper access controls vulnerability in Comply.

  • 8.3 /10 High
    CVE-2026-87034 No auth

    Tanium Comply - SQL Injection

    Tanium Comply contains a sql injection vulnerability caused by unsanitized input in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 8.5 /10 High
    CVE-2026-87030 Auth required

    Tanium Comply - Path Traversal

    Tanium Comply contains a path traversal vulnerability, letting attackers access unauthorized files, exploit requires no special privileges.

  • 8.5 /10 High
    CVE-2026-87023 Auth required

    Tanium Comply - Path Traversal

    Tanium Comply contains a path traversal vulnerability, letting attackers access unauthorized file paths, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-87021

    Tanium Comply - Remote Code Execution

    Tanium Comply contains an unauthorized code execution vulnerability, letting attackers execute code without proper authorization, exploit requires unspecified conditions.

  • 8.1 /10 High
    CVE-2026-87016 PoC publicNo auth

    Open WebUI - Authentication Bypass

    Open WebUI 0.6.41 to 0.11.1 contains an authentication bypass caused by improper JSON matching compiled to SQL LIKE on SQLite, letting attackers impersonate administrator accounts, exploit requires crafted OAuth subject with wildcard characters.

  • 7.5 /10 High
    CVE-2026-87011 PoC public

    Open WebUI - Denial of Service

    Open WebUI 0.9.0 to 0.11.1 contains a denial of service caused by uncached network fetches and blocking signing-key lookup in the unauthenticated POST /oauth/backchannel-logout handler, letting remote attackers stall the single-worker instance and amplify traffic, exploit requires ENABLE_OAUTH_BACKCHANNEL_LOGOUT enabled.

  • 8.6 /10 High
    CVE-2026-86775 No auth

    knowns - Path Traversal

    knowns (npm package) <= 0.29.1 contains a path traversal vulnerability caused by improper sanitization of document paths in the Document API, letting remote unauthenticated attackers read, write, or delete arbitrary .md files, exploit requires unauthenticated access to Management API.

  • 7.6 /10 High
    CVE-2026-86771 PoC publicAuth required

    Snipe-IT - Server Side Request Forgery

    Snipe-IT < 8.7.0 contains a server-side request forgery caused by unescaped employee_num field in the acceptance PDF generator, letting attackers with users.edit permission trigger server-side HTTP requests, exploit requires users.edit permission.

  • 8.1 /10 High
    CVE-2026-86770 PoC publicAuth required

    Snipe-IT - Authentication Bypass

    Snipe-IT < 8.7.0 contains a broken authentication caused by failure to validate username case sensitivity during SAML authentication, letting attackers bypass username matching and achieve account takeover via federated login paths, exploit requires attacker to register IdP accounts with accent or case variants of victim usernames.

  • 8.1 /10 High
    CVE-2026-86762 PoC publicAuth required

    Snipe-IT - Broken Access Control

    Snipe-IT < 8.7.0 contains a broken access control caused by missing CheckUserIsActivated middleware in the API group and non-revocation of personal access tokens, letting attackers with deactivated accounts maintain API access and re-activate themselves.