High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 512 of 552

  • 7.3 /10 High
    CVE-2026-49314 No auth

    Rendering & Composition Module - Out of Bounds Write

    A rendering and composition module contains an out-of-bounds write vulnerability, letting attackers cause denial of service, exploit requires no special conditions.

  • 8.6 /10 High
    CVE-2026-49310

    Unknown Product - Broken Access Control

    An unspecified product contains a broken access control vulnerability in the event notification module, letting attackers affect service confidentiality, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-41870 Auth required

    Apache Nutch - Code Injection

    Apache Nutch 1.11 through 1.22 contains a code injection and unsafe reflection vulnerability caused by missing authorization and improper control of dynamically-managed code in the Nutch REST API, letting attackers execute unauthorized code, exploit requires access to Nutch Server.

  • 7.2 /10 High
    CVE-2026-26212 Auth required

    Rara One Click Demo Import - Unrestricted File Upload

    Rara One Click Demo Import plugin for WordPress < 1.3.5 contains an arbitrary file upload vulnerability caused by disabled file type validation in process_uploaded_files(), letting authenticated administrators upload and execute malicious PHP files remotely.

  • 7.2 /10 High
    CVE-2026-23855 Auth required

    Dell iDRAC - OS Command Injection

    Dell iDRAC9 14G < 7.00.00.184, 15G/16G < 7.30.10.50, and iDRAC10 17G < 1.30.30.50 contain an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands, exploit requires high privilege remote access.

  • 7.5 /10 High
    CVE-2026-22591 No auth

    eProsima Fast DDS - Denial of Service

    eProsima Fast DDS < 2.6.12, < 2.14.6, < 3.2.4, and < 3.4.3 contain a denial of service caused by a deeply nested filter expression in SQL-based content filtering (DDSSQLFilter), letting remote attackers crash participants by sending crafted SEDP DATA submessages, exploit requires network access to DDS domain.

  • 7.1 /10 High
    CVE-2026-21100 Auth required

    SystemUI - Broken Access Control

    SystemUI prior to SMR Sep-2026 Release 1 contains an improper access control vulnerability caused by insufficient restrictions, letting local attackers launch arbitrary activities, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-21094 No auth

    wpa_supplicant - Buffer Overflow

    wpa_supplicant prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation, letting adjacent attackers write out-of-bounds memory remotely, exploit requires network adjacency.

  • 7.8 /10 High
    CVE-2026-21091

    libcodec2secevrcdec.so - Out of Bounds Write

    libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 contains an out-of-bounds write caused by improper memory handling, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21090

    libsaviextractor.so - Out-of-Bounds Write

    libsaviextractor.so prior to SMR Sep-2026 Release 1 contains an out-of-bounds write caused by improper memory handling, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21089 Auth required

    libsubextractor.so - Buffer Overflow

    libsubextractor.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation in removing style tag, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21088 Auth required

    libsubextractor.so - Buffer Overflow

    libsubextractor.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation in loading a subtitle frame, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21087 Auth required

    libmdnie.so - Buffer Overflow

    libmdnie.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by out-of-bounds write, letting local attackers execute arbitrary code with system server privileges, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21086 Auth required

    ProxyHandler - Broken Access Control

    ProxyHandler prior to SMR Aug-2026 Release 1 contains an improper authorization vulnerability caused by insufficient access control, letting local attackers access proxy configuration, exploit requires local access.

  • 7.5 /10 High
    CVE-2026-19201 No auth

    Google go-attestation - Denial of Service

    Google go-attestation <= 0.6.1 contains a denial of service caused by uncontrolled recursion in the Windows SIPA event log parser's readELAMAggregation function, letting attackers crash the verifier via crafted nested elamAggregation events, exploit requires crafted Windows event log input.