High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 685 of 725

  • 8.2 /10 High
    CVE-2026-53938 No auth

    OpenIDC cjose - Out of Bounds Read/Write

    OpenIDC cjose < 0.6.2.5 contains a buffer overflow caused by lack of length validation on attacker-supplied encrypted_key in AES Key Wrap algorithms during JWE decryption, letting remote unauthenticated attackers cause heap corruption and denial of service, exploit requires crafted JWE input.

  • 7.5 /10 High
    CVE-2026-52482 No auth

    SJRC F11 SJ-GPS-PRO - Information Disclosure

    SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 contains an information disclosure vulnerability caused by inetd service spawning /app/sh_for_telnet, letting remote attackers obtain sensitive information, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-49315 No auth

    Input Device Module - Denial of Service

    An input device module contains a denial of service vulnerability caused by unspecified input handling issues, letting attackers disrupt availability, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-49314 No auth

    Rendering & Composition Module - Out of Bounds Write

    A rendering and composition module contains an out-of-bounds write vulnerability, letting attackers cause denial of service, exploit requires no special conditions.

  • 8.6 /10 High
    CVE-2026-49310

    Unknown Product - Broken Access Control

    An unspecified product contains a broken access control vulnerability in the event notification module, letting attackers affect service confidentiality, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-41870 Auth required

    Apache Nutch - Code Injection

    Apache Nutch 1.11 through 1.22 contains a code injection and unsafe reflection vulnerability caused by missing authorization and improper control of dynamically-managed code in the Nutch REST API, letting attackers execute unauthorized code, exploit requires access to Nutch Server.

  • 7.2 /10 High
    CVE-2026-26212 Auth required

    Rara One Click Demo Import - Unrestricted File Upload

    Rara One Click Demo Import plugin for WordPress < 1.3.5 contains an arbitrary file upload vulnerability caused by disabled file type validation in process_uploaded_files(), letting authenticated administrators upload and execute malicious PHP files remotely.

  • 7.2 /10 High
    CVE-2026-23855 Auth required

    Dell iDRAC - OS Command Injection

    Dell iDRAC9 14G < 7.00.00.184, 15G/16G < 7.30.10.50, and iDRAC10 17G < 1.30.30.50 contain an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands, exploit requires high privilege remote access.

  • 7.5 /10 High
    CVE-2026-22591 No auth

    eProsima Fast DDS - Denial of Service

    eProsima Fast DDS < 2.6.12, < 2.14.6, < 3.2.4, and < 3.4.3 contain a denial of service caused by a deeply nested filter expression in SQL-based content filtering (DDSSQLFilter), letting remote attackers crash participants by sending crafted SEDP DATA submessages, exploit requires network access to DDS domain.

  • 7.1 /10 High
    CVE-2026-21100 Auth required

    SystemUI - Broken Access Control

    SystemUI prior to SMR Sep-2026 Release 1 contains an improper access control vulnerability caused by insufficient restrictions, letting local attackers launch arbitrary activities, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-21094 No auth

    wpa_supplicant - Buffer Overflow

    wpa_supplicant prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation, letting adjacent attackers write out-of-bounds memory remotely, exploit requires network adjacency.

  • 7.8 /10 High
    CVE-2026-21091

    libcodec2secevrcdec.so - Out of Bounds Write

    libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 contains an out-of-bounds write caused by improper memory handling, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21090

    libsaviextractor.so - Out-of-Bounds Write

    libsaviextractor.so prior to SMR Sep-2026 Release 1 contains an out-of-bounds write caused by improper memory handling, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21089 Auth required

    libsubextractor.so - Buffer Overflow

    libsubextractor.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation in removing style tag, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21088 Auth required

    libsubextractor.so - Buffer Overflow

    libsubextractor.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation in loading a subtitle frame, letting local attackers write out-of-bounds memory, exploit requires local access.