High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 7 of 725

  • 7.5 /10 High
    CVE-2026-20499 No auth

    Modem - Privilege Escalation

    Modem contains an out of bounds write caused by missing bounds check, letting remote attackers escalate privileges if UE connects to a rogue base station, exploit requires no additional privileges or user interaction.

  • 8.8 /10 High
    CVE-2026-18199 Auth required

    Zohocorp ManageEngine Password Manager Pro & PAM360 - Remote Code Execution

    Zohocorp ManageEngine Password Manager Pro < 13236 and PAM360 < 8601 contain an authenticated remote code execution caused by improper input handling, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.

  • 7.5 /10 High
    CVE-2026-120752 Auth required

    PyMuPDF - Buffer Overflow

    PyMuPDF < 2.0 contains a stack-based buffer overflow caused by copying caller-supplied callout points into a fixed three-element stack array in JM_set_annot_callout_line, letting attackers crash the process or execute code by supplying four or more points via Page.add_freetext_annot.

  • 7.5 /10 High
    CVE-2026-120596 No auth

    Ethernut Nut/OS - Denial of Service

    Ethernut Nut/OS <= 5.1 contains a denial-of-service caused by a malformed TCP option with zero length in NutTcpInputOptions, letting unauthenticated remote attackers block TCP services, exploit requires sending crafted TCP segment.

  • 7.2 /10 High
    CVE-2026-120487 Auth required

    LaraDashboard - Broken Access Control

    LaraDashboard < 1.4.5 contains a broken access control vulnerability in SettingPolicy::manageCoreUpgrades(), letting non-Superadmin administrators with settings.edit access Superadmin-only core-upgrade operations, exploit requires settings.edit privilege.

  • 8.8 /10 High
    CVE-2026-120461 Auth required

    Jpom - Broken Access Control

    Jpom <= 2.11.12 contains a broken access control caused by lack of workspace filtering in POST /node/ssh_command/batch, letting authenticated users with SSH command execute permission run commands on other workspaces' SSH hosts.

  • 8.8 /10 High
    CVE-2026-120460 Auth required

    Jpom - Broken Access Control

    Jpom <= 2.11.12 contains a broken access control caused by cross-workspace authorization bypass via foreign Docker asset IDs, letting authenticated users with Docker permissions manage other workspaces' Docker hosts.

  • 7.4 /10 High
    CVE-2026-120459 No auth

    python-jose - Authentication Bypass

    python-jose <= 3.5.0 contains an authentication bypass caused by acceptance of zero-length HMAC secrets in HMACKey and CryptographyHMACKey, letting unauthenticated attackers forge JWTs with arbitrary claims, exploit requires empty verification key.

  • 8.1 /10 High
    CVE-2026-120448 Auth required

    DoraCMS - Broken Access Control

    DoraCMS <= 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint, letting authenticated low-privileged users rebind API keys to other users, enabling profile modification and content control.

  • 8.1 /10 High
    CVE-2026-120447 No auth

    HotGo - Authentication Bypass

    HotGo <= 2.15.1 contains an authentication bypass caused by unauthenticated attackers setting SMS login verification codes via /admin/sms/send, letting attackers take over user accounts including administrators, exploit requires knowledge of user's mobile number.

  • 8.8 /10 High
    CVE-2026-120445 Auth required

    madong-admin-saas - Broken Access Control

    madong-admin-saas <= 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware, letting authenticated tenant users access platform management API, create admin accounts, and control tenants, exploit requires tenant user authentication.

  • 8.1 /10 High
    CVE-2026-120444 No auth

    GoFound - Path Traversal

    GoFound <= 1.4.1 contains a path traversal vulnerability caused by improper sanitization of the database parameter in /api/db/create and /api/db/drop endpoints, letting unauthenticated attackers delete arbitrary directories.

  • 7.0 /10 High
    CVE-2026-120439 No auth

    QuickJS-NG - Integer Overflow

    QuickJS-NG < 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c, letting attackers running JavaScript cause heap buffer overflow on 32-bit hosts by sorting large typed arrays with a comparator.

  • 7.8 /10 High
    CVE-2026-120438 Auth required

    QuickJS-NG - Integer Overflow

    QuickJS-NG < 0.16.0 contains an integer overflow caused by improper handling in js_proxy_get_own_property_names() in quickjs.c, letting attackers running JavaScript cause heap buffer overflow and potential code execution, exploit requires attacker to run JavaScript code.

  • 7.8 /10 High
    CVE-2026-120436 No auth

    Netpbm - Integer Overflow

    Netpbm < 10.86.51, 11.x < 11.02.30, and 11.03 < 11.15.08 contain an integer overflow in jbigtopnm causing a heap buffer overflow in jbg_dec_merge_planes(), letting attackers execute code or cause crashes via crafted multi-plane JBIG files.