High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 588 of 628

  • 7.5 /10 High
    CVE-2026-22591 No auth

    eProsima Fast DDS - Denial of Service

    eProsima Fast DDS < 2.6.12, < 2.14.6, < 3.2.4, and < 3.4.3 contain a denial of service caused by a deeply nested filter expression in SQL-based content filtering (DDSSQLFilter), letting remote attackers crash participants by sending crafted SEDP DATA submessages, exploit requires network access to DDS domain.

  • 7.1 /10 High
    CVE-2026-21100 Auth required

    SystemUI - Broken Access Control

    SystemUI prior to SMR Sep-2026 Release 1 contains an improper access control vulnerability caused by insufficient restrictions, letting local attackers launch arbitrary activities, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-21094 No auth

    wpa_supplicant - Buffer Overflow

    wpa_supplicant prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation, letting adjacent attackers write out-of-bounds memory remotely, exploit requires network adjacency.

  • 7.8 /10 High
    CVE-2026-21091

    libcodec2secevrcdec.so - Out of Bounds Write

    libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 contains an out-of-bounds write caused by improper memory handling, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21090

    libsaviextractor.so - Out-of-Bounds Write

    libsaviextractor.so prior to SMR Sep-2026 Release 1 contains an out-of-bounds write caused by improper memory handling, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21089 Auth required

    libsubextractor.so - Buffer Overflow

    libsubextractor.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation in removing style tag, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21088 Auth required

    libsubextractor.so - Buffer Overflow

    libsubextractor.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation in loading a subtitle frame, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21087 Auth required

    libmdnie.so - Buffer Overflow

    libmdnie.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by out-of-bounds write, letting local attackers execute arbitrary code with system server privileges, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21086 Auth required

    ProxyHandler - Broken Access Control

    ProxyHandler prior to SMR Aug-2026 Release 1 contains an improper authorization vulnerability caused by insufficient access control, letting local attackers access proxy configuration, exploit requires local access.

  • 7.5 /10 High
    CVE-2026-19201 No auth

    Google go-attestation - Denial of Service

    Google go-attestation <= 0.6.1 contains a denial of service caused by uncontrolled recursion in the Windows SIPA event log parser's readELAMAggregation function, letting attackers crash the verifier via crafted nested elamAggregation events, exploit requires crafted Windows event log input.

  • 8.1 /10 High
    CVE-2026-18147 No auth

    FreeIPA - Stored XSS

    FreeIPA contains a stored XSS caused by DOM manipulation in the Web UI password reset page, letting unauthenticated remote attackers execute arbitrary JavaScript via crafted links, exploit requires victim interaction.

  • 7.2 /10 High
    CVE-2026-17553 Auth required

    WP EasyCart - Privilege Escalation

    WP EasyCart <= 5.9.3 contains a privilege escalation caused by insecure update_option() calls in ec_ajax_save_page_default_options() AJAX handler, letting authenticated Store Manager-level users escalate to administrator by modifying WordPress options, exploit requires authenticated user with Store Manager or higher privileges.

  • 7.5 /10 High
    CVE-2026-16960 No auth

    Loops & Logic WordPress - Information Disclosure

    Loops & Logic WordPress plugin < 4.3.0 contains an information disclosure vulnerability caused by insufficient restriction on public template-data action, letting unauthenticated users read arbitrary user records and site options, exploit requires no authentication.

  • 7.7 /10 High
    CVE-2026-15913 Auth required

    Fortra GoAnywhere MFT - Path Traversal

    Fortra GoAnywhere MFT < 7.10.2 contains a path traversal caused by improper validation in /attachRemoteFiles endpoint, letting web users with Secure Folders and Secure Mail permissions read arbitrary files outside their sandbox, exploit requires specific permissions.

  • 7.5 /10 High
    CVE-2026-15667 PoC publicAuth required

    Eventin WordPress Plugin - Local File Inclusion

    Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated contributors execute arbitrary PHP code, exploit requires contributor-level access.