High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 575 of 628
- 8.3 /10 HighCVE-2026-64838 Auth required
ICEcoder - Path Traversal
ICEcoder <= 8.1 contains a path traversal vulnerability caused by improper validation of the oldFileName parameter in file move and rename operations, letting authenticated users move files outside the document root into web-accessible directories, exploit requires authentication.
- 8.8 /10 HighCVE-2026-64837 Auth required
ICEcoder - Command Injection
ICEcoder through 8.1 contains a command injection caused by unescaped filesystem path in lib/properties.php, letting authenticated users execute arbitrary OS commands via directory names, exploit requires user authentication.
- 8.8 /10 HighCVE-2026-64836 Auth required
ICEcoder - Path Traversal
ICEcoder <= 8.1 contains a path traversal caused by a logic error in document-root confinement check in file-control endpoint, letting authenticated attackers read, write, or delete files outside document root.
- 7.8 /10 HighCVE-2026-63427 Auth required
Lenovo Software Fix - Authentication Bypass
Lenovo Software Fix contains an authentication bypass vulnerability that allows a local authenticated user to execute arbitrary code with elevated privileges, exploit requires local authenticated access.
- 7.5 /10 HighCVE-2026-6285 No auth
Ankaref Innovation and Technology Inc. LIBRID/LIBREF - Authentication Bypass
Ankaref Innovation and Technology Inc. LIBRID/LIBREF 2.01.0.2183 through 10092026 contains a weak password recovery mechanism caused by insecure password reset process, letting attackers exploit password recovery to gain unauthorized access, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-49363 No auth
Apache Artemis - Information Disclosure
Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0 contain an information disclosure vulnerability caused by unauthenticated CORE protocol SUBSCRIBE_TOPOLOGY requests, letting remote attackers discover cluster node details without authentication.
- 7.5 /10 HighCVE-2026-49362 No auth
Apache Artemis - Broken Access Control
Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0 contain an unauthorized broker state manipulation vulnerability caused by unauthenticated remote creation of arbitrary durable queues via the CORE protocol, letting unauthenticated attackers cause denial of service.
- 7.5 /10 HighCVE-2026-46387 No auth
Suricata - Denial of Service
Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by unbounded HTTP/2 decompression buffer growth, letting remote attackers exhaust memory via crafted compressed HTTP/2 DATA payloads, exploit requires network access.
- 7.5 /10 HighCVE-2026-45770 No auth
Suricata - Sandbox Bypass & Denial of Service
Suricata >= 8.0.0 and < 8.0.5 contains a sandbox bypass and denial of service caused by excessive flow variable registration in Lua rules, letting attackers bypass Lua sandbox or crash Suricata, exploit requires loading a crafted Lua script/rule.
- 7.5 /10 HighCVE-2026-45769 No auth
Suricata - Denial of Service
Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by unbounded growth of IKEv2 parser state when storing client transforms, letting attackers cause excessive memory consumption via crafted UDP traffic, exploit requires repeated crafted UDP packets.
- 7.5 /10 HighCVE-2026-45768 No auth
Suricata - Denial of Service
Suricata 8.0.0 to < 8.0.5 contains a denial of service caused by unbounded LDAP transaction state storing excessive responses, letting attackers cause memory exhaustion via crafted UDP LDAP traffic, exploit requires crafted network traffic.
- 7.5 /10 HighCVE-2026-45766 No auth
Suricata - Denial of Service
Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by insufficiently bounded NFS parser state structures, letting remote attackers cause excessive memory consumption, exploit requires crafted NFS traffic.
- 7.5 /10 HighCVE-2026-45765 No auth
Suricata - Denial of Service
Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by insufficient parser-level bounds in DNP3 reassembly, letting attackers cause excessive memory consumption remotely, exploit requires crafted DNP3 traffic.
- 7.5 /10 HighCVE-2026-45762 No auth
Suricata - Denial of Service
Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by improper IP defragmentation tracker lookup allowing IPv6 fragments to be associated with IPv4 trackers, letting remote attackers crash the system via crafted fragmented packets, exploit requires crafted fragmented IPv4/IPv6 traffic.
- 7.5 /10 HighCVE-2026-45759 No auth
Suricata - Denial of Service
Suricata < 7.0.16 and < 8.0.5 contains a denial of service caused by expensive parsing of large HTTP Content-Disposition headers during HTTP response processing, letting attackers cause excessive CPU usage remotely, exploit requires crafted HTTP traffic.