High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 630 of 725

  • 8.8 /10 High
    CVE-2026-82779 Auth required

    CONPROSYS TM Series - Command Injection

    CONPROSYS TM Series contains an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.8 /10 High
    CVE-2026-82777 Auth required

    CONPROSYS PAC Series - OS Command Injection

    CONPROSYS PAC Series contains an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.8 /10 High
    CVE-2026-82774 Auth required

    CONPROSYS M2M Gateway & Controller Series - OS Command Injection

    CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series contain an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.8 /10 High
    CVE-2026-82772 Auth required

    Contec EC1000 - Buffer Overflow

    Contec EC1000 series contains a buffer overflow caused by improper handling of specially crafted requests in the web service, letting remote attackers execute arbitrary programs remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-82770 Auth required

    Contec RP-WAH-SR Series - Buffer Overflow

    Contec RP-WAH-SR Series contains a buffer overflow caused by improper handling of specially crafted requests in the web service, letting remote attackers execute arbitrary programs, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-82768 Auth required

    SGA1000 - Path Traversal

    SGA1000 contains a path traversal vulnerability that allows attackers with FTP access to view or modify arbitrary files on the server, exploit requires FTP access.

  • 8.8 /10 High
    CVE-2026-82766 Auth required

    SGA1000 - OS Command Injection

    SGA1000 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.1 /10 High
    CVE-2026-82765 Auth required

    Contec FX Series - Path Traversal

    Contec FX5000, FX4000, and FX3000 series contain a path traversal vulnerability caused by improper input validation in FTP access, letting attackers view or alter arbitrary files on the server, exploit requires FTP access.

  • 8.8 /10 High
    CVE-2026-82762 Auth required

    Contec FX Series - OS Command Injection

    Contec FX5000, FX4000, and FX3000 series contain an OS command injection caused by improper neutralization of special elements in OS commands, letting logged-in attackers execute arbitrary OS commands.

  • 8.1 /10 High
    CVE-2026-82438 Auth required

    Apache Storm - Broken Access Control

    Apache Storm < 3.1.0 contains a broken access control caused by improper CORS and JSONP handling in HTTP components, letting authenticated users' web pages on unrelated origins read sensitive cluster and log data, exploit requires authenticated user interaction.

  • 8.1 /10 High
    CVE-2026-82432

    Apache Nimbus - Broken Access Control

    Apache Nimbus < 3.1.0 contains an authorization bypass caused by insufficient validation of topology.blobstore.map and lack of authorization in listBlobs, letting attackers with rebalance rights or network access disclose blob metadata and introduce unauthorized blobstore entries, exploit requires rebalance privileges or network access to Nimbus Thrift port.

  • 7.8 /10 High
    CVE-2026-82430 Auth required

    Apache Storm - Command Injection

    Apache Storm contains a command injection caused by improper validation and ownership change timing in the worker-launcher command file handling, letting attackers launch root-equivalent containers or bind-mount arbitrary host paths, exploit requires tenant control over worker directory.

  • 7.8 /10 High
    CVE-2026-82429 Auth required

    Apache Storm - Privilege Escalation

    Apache Storm < 3.1.0 contains a privilege escalation caused by TOCTOU race condition in setuid-root worker-launcher binary using lchown and chmod on re-resolved paths, letting untrusted tenant escalate privileges by symlink attack, exploit requires running untrusted topology code on supervisor node.

  • 8.8 /10 High
    CVE-2026-82428 Auth required

    Apache Storm - Remote Code Execution

    Apache Storm before 3.1.0 contains a remote code execution vulnerability caused by predictable blob keys for dependency artifacts uploaded with `storm jar --artifacts`, letting a malicious user inject code into other tenants' topologies, exploit requires multi-tenant cluster and use of `--artifacts` feature.

  • 7.8 /10 High
    CVE-2026-82427 Auth required

    Apache Storm - Path Traversal & Remote Code Execution

    Apache Storm contains a path traversal vulnerability in topology.blobstore.map allowing submitters to manipulate symlink targets, letting attackers as supervisor user delete files and execute code as other OS users, exploit requires topology submission.