High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 668 of 725

  • 7.3 /10 High
    CVE-2026-87925 No auth

    Rizwan17 inventory-management-system - SQL Injection

    Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f contains a SQL injection caused by manipulation of the argument pro_name[] in storeCustomerOrderInvoice function in includes/manage.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-87803 Auth required

    Countly Server - Authorization Bypass

    Countly Server DBViewer contains an authorization bypass caused by flawed sub-pipeline detection in the aggregation stage sanitizer, letting non-admin users with read permission perform unauthorized cross-collection joins and access sensitive data, exploit requires DBViewer read permission.

  • 8.3 /10 High
    CVE-2026-87090 Auth required

    Consul - Authorization Bypass

    Consul and Consul Enterprise contain an authorization bypass caused by improper access control in the catalog node-write path, letting authenticated attackers delete other nodes' catalog registrations and take over node identities, exploit requires node-write permission and knowledge of target node ID.

  • 7.5 /10 High
    CVE-2026-86093

    IBM Db2 - Command Injection

    IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a command injection caused by a stack-based buffer overflow in DRDA server endpoint handling, letting attackers execute arbitrary commands on clients, exploit requires control or impersonation of DRDA server endpoint.

  • 7.1 /10 High
    CVE-2026-85545 Auth required

    HikCentral Access Control - Broken Access Control

    HikCentral Access Control contains a broken access control vulnerability caused by authenticated low-privilege users invoking unauthorized API interfaces, letting attackers access restricted functions, exploit requires authenticated low-privilege user.

  • 8.6 /10 High
    CVE-2026-85217 No auth

    Autodesk Fusion Desktop - Broken Access Control

    Autodesk Fusion Desktop contains a broken access control vulnerability caused by a maliciously crafted add-in modifying persistent network proxy settings without user consent, letting attackers redirect authenticated network traffic, exploit requires add-in installation and execution.

  • 8.8 /10 High
    CVE-2026-84889 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.10.3 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting remote authenticated attackers execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-84821 No auth

    WP Fast Total Search - Broken Access Control

    WP Fast Total Search <= 1.82.284 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-84819 No auth

    WPAdverts - Reflected XSS

    WPAdverts <= 2.3.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-84816 No auth

    WPCS - Reflected XSS

    WPCS <= 1.3.2 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.8 /10 High
    CVE-2026-84042 Auth required

    crun - Privilege Escalation

    crun >= 1.29 contains a privilege escalation caused by executing attacker-controlled payload from container image with host root privileges when built with libkrun and rootful passt networking, letting attackers gain host root privileges, exploit requires rootful container with passt networking enabled.

  • 8.1 /10 High
    CVE-2026-82925 No auth

    Site Reviews WordPress - Insecure Deserialization

    Site Reviews WordPress plugin < 8.3.0 contains an insecure deserialization vulnerability caused by predictable key derivation from WordPress nonce key, letting unauthenticated users inject arbitrary PHP objects, exploit requires weak or default nonce key.

  • 8.8 /10 High
    CVE-2026-82099 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-82098 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 8.8 /10 High
    CVE-2026-82097 Auth required

    IBM DataStage on Cloud Pak for Data - Remote Code Execution

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a server-side request forgery caused by improper validation of URLs, letting remote authenticated attackers execute arbitrary code.