High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 6 of 552
- 8.8 /10 HighCVE-2026-108426 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-108440 No auth
Microsoft Office Word - Buffer Overflow
Microsoft Office Word contains a stack-based buffer overflow caused by improper handling of input, letting unauthorized attackers execute code remotely over a network, exploit requires network access.
- 7.5 /10 HighCVE-2026-108448 No auth
Microsoft Office Outlook - Remote Code Execution
Microsoft Office Outlook contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-108446 No auth
Microsoft Office Excel - Remote Code Execution
Microsoft Office Excel contains a use after free vulnerability that allows unauthorized attackers to execute code over a network, exploit requires network access.
- 7.4 /10 HighCVE-2026-111356 No auth
MacCMS - Authentication Bypass
MacCMS v10 through 2026.1000.4056 contains a broken authentication caused by unlimited attempts on six-digit password recovery code, letting unauthenticated attackers take over member accounts via brute-force, exploit requires knowledge of victim's email or phone.
- 8.3 /10 HighCVE-2026-77470 No auth
Lychee - Broken Access Control
Lychee < 7.7.1 contains a broken access control vulnerability caused by unrestricted additional_data array merging in the webshop checkout process, letting unauthenticated buyers manipulate payment parameters to underpay, exploit requires enabled webshop, purchasable item, and affected Omnipay gateway.
- 8.2 /10 HighCVE-2026-61838 No auth
Lychee - Authorization Bypass
Lychee < 7.6.3 contains an authorization bypass caused by missing access enforcement in album and photo archive downloads, letting unauthenticated attackers download protected album ZIP archives, exploit requires knowledge of shared album identifier.
- 8.3 /10 HighCVE-2026-77466 No auth
Lychee - Authentication Bypass
Lychee < 7.7.0 contains a broken authentication caused by insufficient validation of payment providers in CreateSessionRequest, letting buyers bypass payment and complete orders, exploit requires access to Supporter or Pro webshop with purchasable items enabled.
- 7.5 /10 HighCVE-2026-61611 No auth
Lychee - Authentication Bypass
Lychee < 7.6.1 contains a brute force vulnerability caused by lack of throttling and authentication checks in Album unlock API, letting remote unauthenticated attackers guess album passwords and access private photos.
- 7.5 /10 HighCVE-2026-95179 No auth
lottie-android - Denial of Service
lottie-android <= 6.7.1 contains a denial of service caused by a crafted Lottie animation JSON with cyclic precomposition references triggering uncontrolled recursion in BaseLayer.forModel and CompositionLayer, letting remote attackers cause DoS, exploit requires crafted animation JSON.
- 7.5 /10 HighCVE-2026-111160 No auth
LightLLM - Denial of Service
LightLLM through 1.2.0 contains a denial of service vulnerability caused by improper handling of the internal pd_kv_trans_params field in the /generate endpoint, letting unauthenticated attackers crash the inference worker, exploit requires sending a crafted request.
- 7.5 /10 HighCVE-2026-103936 No auth
libp2p - Denial of Service
libp2p < 6.0.28 contains a denial of service caused by unauthenticated STUN Binding Requests processed before authentication, letting remote attackers crash the process via crafted UDP packets, exploit requires network access.
- 7.5 /10 HighCVE-2026-97394 No auth
kin-openapi - Denial of Service
kin-openapi 0.136.0 to 0.143.0 contains a null pointer dereference caused by accepting OpenAPI 3.1 array schemas without an items keyword in openapi3filter, letting remote unauthenticated clients trigger a panic during request or response validation, exploit requires sending nonempty requests or matching responses.
- 7.5 /10 HighCVE-2026-100354 No auth
kin-openapi - Denial of Service
kin-openapi < 0.149.0 contains a denial of service caused by lack of cycle detection in runtime validation of schemas with circular references, letting attackers cause unbounded recursion and crash the process, exploit requires crafted request triggering affected schema.
- 7.5 /10 HighCVE-2026-100353 No auth
kin-openapi - Denial of Service
kin-openapi 0.136.0 to 0.149.0 contains a denial of service caused by missing nil-items guard in openapi3filter decoder paths for OpenAPI 3.1 array schemas, letting unauthenticated remote clients trigger nil-pointer panic via crafted query or request body parameters, exploit requires crafted request with specific array parameters.