High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 654 of 725
- 8.8 /10 HighCVE-2026-89445 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in iommufd selftest IOPF reporting caused by unsynchronized access to attach handles during PASID detach, letting attackers cause memory corruption, exploit requires concurrent device fault reporting.
- 7.1 /10 HighCVE-2026-89443 Auth required
Linux Kernel - Out-of-Bounds Read
Linux kernel contains an out-of-bounds read vulnerability caused by lack of validation of user-provided level in perf mask ioctls in platform/x86 ISST component, letting attackers cause memory disclosure, exploit requires crafted ioctl input.
- 7.8 /10 HighCVE-2026-89442 Auth required
Linux Kernel - Out of Bounds Read/Write
Linux kernel contains a buffer overflow caused by improper validation of socket_id in ISST clos_assoc ioctl, letting local attackers cause out-of-bounds access and NULL pointer dereference, exploit requires local access.
- 7.8 /10 HighCVE-2026-89441 Auth required
Linux kernel mmc via-sdmmc - Use After Free
Linux kernel mmc via-sdmmc contains a use-after-free vulnerability caused by card-detect work running after device removal, letting attackers cause memory corruption, exploit requires device removal triggering.
- 7.8 /10 HighCVE-2026-89440 Auth required
Linux Kernel mmc via-sdmmc - Use After Free
Linux kernel mmc via-sdmmc contains a use-after-free vulnerability caused by improper interrupt handling on probe failure, letting attackers cause kernel memory corruption, exploit requires triggering probe failure.
- 7.8 /10 HighCVE-2026-89436 Auth required
Linux kernel panasonic-laptop - Out of Bounds Read/Write
Linux kernel platform/x86 panasonic-laptop contains a buffer overflow caused by improper sentinel write past pcc->sinf[] array bounds, letting attackers cause heap overflow, exploit requires specific hardware with off-by-one DSDT SINF package count.
- 7.5 /10 HighCVE-2026-89262 No auth
MoguBlog - Authorization Bypass
MoguBlog <= 6.2 contains an authorization bypass caused by ownership checks against request-body fields instead of the authenticated principal in the comment deletion endpoint, letting attackers delete arbitrary comments and replies, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-89260 No auth
MoguBlog - XML External Entity Injection
MoguBlog through 6.2 contains an XML external entity injection caused by unhardened dom4j SAXReader usage in WeChat callback handler at POST /wechat/wechatCheck, letting unauthenticated remote attackers read local files or trigger outbound HTTP requests, exploit requires crafted XML with DOCTYPE declarations.
- 8.7 /10 HighCVE-2026-89256 Auth required
AVideo - Stored XSS
AVideo contains a stored XSS caused by lack of encoding of chapter names in the Bookmark plugin, letting video owners inject scripts executed by every visitor on the public watch page, exploit requires video ownership.
- 8.7 /10 HighCVE-2026-89255 Auth required
AVideo - Stored XSS
AVideo contains a stored XSS caused by failure to HTML-encode PGP public keys in LoginControl plugin textarea, letting authenticated attackers execute JavaScript in administrator sessions when viewing user profiles.
- 8.7 /10 HighCVE-2026-89254 Auth required
AVideo - Stored XSS
AVideo contains a stored XSS caused by unsanitized field_name parameter in CustomizeUser plugin via add.json.php, letting administrators inject scripts that execute on extra info or profile pages, exploit requires admin privileges.
- 8.7 /10 HighCVE-2026-89253 Auth required
WWBN AVideo - Stored XSS
WWBN AVideo contains a stored XSS caused by improper validation and encoding of the 'donationLink' user profile field, letting authenticated users inject JavaScript that executes in visitors' browsers, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-89250 No auth
WWBN AVideo - Unauthorized File Read
WWBN AVideo contains an unauthenticated file read vulnerability caused by lack of authentication and authorization checks in getRecordedFile.php endpoint, letting attackers download recorded live video files using known or guessed stream keys.
- 8.7 /10 HighCVE-2026-89249 Auth required
AVideo - Stored XSS
AVideo contains a stored XSS caused by base64-encoded but unescaped user-supplied CryptoWallet values in YPTWallet plugin, letting attackers execute scripts in admin sessions, exploit requires admin to view pending requests.
- 8.1 /10 HighCVE-2026-89243 Auth required
WWBN AVideo - Stored XSS
WWBN AVideo contains a stored XSS caused by lack of sanitization in UserGroups::setGroup_name(), letting administrators with canAdminUserGroups permission inject malicious scripts executed by other administrators, exploit requires admin privileges.