High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 660 of 725

  • 7.5 /10 High
    CVE-2026-79394 No auth

    Xiongmai IP Camera XM530 - Authentication Bypass

    Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier contains an authentication bypass caused by insecure default configuration in the embedded Happytime RTSP server within Sofia IPC daemon, letting remote unauthenticated attackers access live video and audio feeds in cleartext over unencrypted RTP/UDP, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-79393 No auth

    Xiongmai IP Camera XM530 - Buffer Overflow

    Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier contains a heap-based buffer overflow caused by improper handling of wsa5:Action string in WS-Addressing Action transformation function in Sofia IPC daemon, letting remote unauthenticated attackers cause denial of service or execute arbitrary code via crafted SOAP request.

  • 8.8 /10 High
    CVE-2026-79362 Auth required

    Woltlab WCF - Remote Code Execution

    Woltlab WCF >= 6.1.0 < 6.1.23 and >= 6.2.0 < 6.2.6 contain a remote code execution caused by cache poisoning via premature nowdoc termination in executable cache files, letting authenticated low-privileged users execute arbitrary PHP code.

  • 7.1 /10 High
    CVE-2026-78807 Auth required

    wpa_supplicant - Broken Access Control

    wpa_supplicant < 2.12 contains a broken access control vulnerability caused by missing validation in the driver-based PMKSA selection path in wpa.c, letting local attackers bypass proper network context and AKMP matching for PMKSA caching, exploit requires local access.

  • 8.4 /10 High
    CVE-2026-7863 No auth

    TUBITAK BILGEM Pardus Software - OS Command Injection

    TUBITAK BILGEM Pardus Software < 1.0.5 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-78224 No auth

    XSLT Transformer Step - XML External Entity Injection

    XSLT Transformer Step contains an XML External Entity (XXE) injection caused by insecure TransformerFactory configuration, letting attackers exfiltrate data and cause denial-of-service, exploit requires crafted XML input.

  • 7.1 /10 High
    CVE-2026-78134 Auth required

    strongSwan - Broken Access Control

    strongSwan 4.5.0 through 6.0.7 contains an incorrect access control vulnerability caused by missing or mismatched inner EAP identity in eap-ttls and eap-peap plugins, letting attackers bypass access restrictions, exploit requires crafted EAP messages.

  • 7.5 /10 High
    CVE-2026-78133 Auth required

    strongSwan - Use After Free

    strongSwan 6.0.0 through 6.0.7 contains a use-after-free caused by IKEv2 rekeying collision handling in libcharon, letting attackers cause memory corruption, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-78132 No auth

    strongSwan - Denial of Service

    strongSwan 5.1.3 through 6.0.7 contains a denial of service caused by an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax, letting attackers cause service disruption, exploit requires crafted certificate input.

  • 7.5 /10 High
    CVE-2026-78130 No auth

    strongSwan - Denial of Service

    strongSwan 4.2.0 through 6.0.7 contains a null pointer dereference caused by a flaw in the x509 plugin's attribute certificate parser, letting attackers cause denial of service, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-77807

    AcyMailing WordPress Plugin - Path Traversal

    AcyMailing WordPress plugin <= 11.0.4 contains a directory traversal caused by improper sanitization of the `user[name]` parameter, letting unauthenticated attackers read arbitrary files, exploit requires 'Embed images' option enabled.

  • 7.2 /10 High
    CVE-2026-74925 Auth required

    MultiVendorX WordPress plugin - Broken Access Control

    MultiVendorX WordPress plugin < 5.0.16 contains a broken access control vulnerability caused by lack of restrictions on role and capability updates, letting users with vendor role escalate to administrator privileges and take over the site, exploit requires user to have vendor role.

  • 7.5 /10 High
    CVE-2026-73785 No auth

    HPE IceWall Federation Agent and Proxy - Denial of Service

    HPE IceWall Federation Agent and Proxy contains a denial of service vulnerability that allows remote unauthenticated attackers to cause service disruption, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-73784 Auth required

    HPE IceWall - Authentication Bypass

    HPE IceWall contains a broken access control vulnerability caused by tampering of SAML response, letting attackers impersonate other users, exploit requires crafted SAML response.

  • 7.5 /10 High
    CVE-2026-72708 PoC publicNo auth

    SPIP - SQL Injection

    SPIP < 4.4.18 contains an unauthenticated blind SQL injection caused by improper escaping in spip_mysql_cite() for date columns in the public sitemap endpoint, letting attackers extract database content via crafted annee parameter.