High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 7 of 552

  • 7.5 /10 High
    CVE-2026-100352 No auth

    kin-openapi - Denial of Service

    kin-openapi < 0.148.0 contains a denial of service caused by improper handling of YAML NaN and infinity numeric values in validation, letting remote unauthenticated clients cause server panic and potential process termination, exploit requires sending crafted YAML request bodies.

  • 8.2 /10 High
    CVE-2026-100349 No auth

    kin-openapi - Denial of Service

    kin-openapi < 0.146.0 contains a denial of service caused by passing a nil response header schema to decodeValue in openapi3filter.ValidateResponse, letting remote attackers or local users cause application crashes, exploit requires triggering the affected operation.

  • 7.4 /10 High
    CVE-2026-100351 No auth

    kin-openapi - Authentication Bypass

    kin-openapi 0.144.0 to 0.147.0 contains an authentication bypass caused by mismatch between decoded URL.Path validation and raw URL.RawPath dispatch in gorilla/mux router, letting unauthenticated remote attackers access protected handlers, exploit requires overlapping public and protected routes with encoded path separator.

  • 7.5 /10 High
    CVE-2026-97370 No auth

    Junrar - Denial of Service

    Junrar prior to 7.6.1 contains a denial of service caused by improper handling of VM_JMP instruction in RarVM.java, letting attackers cause infinite CPU loops and exhaust worker capacity, exploit requires crafted RAR4 archive.

  • 8.1 /10 High
    CVE-2026-111094 No auth

    JetBrains TeamCity - Remote Code Execution

    JetBrains TeamCity < 2026.2, 2026.1.4, 2025.11.8 contains a remote code execution caused by whitelist bypass in the build messages protocol, letting remote attackers execute arbitrary code, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-111093 No auth

    JetBrains Datalore - Path Traversal

    JetBrains Datalore < 2026.2.1 contains a path traversal caused by unauthenticated access to the report blob endpoint, letting unauthenticated attackers read arbitrary files remotely, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-104828 No auth

    HtmlUnit Neko - Stored XSS

    HtmlUnit Neko < 5.4.0 contains a stored XSS caused by improper entity encoding in TEXTAREA and TITLE elements during parse-and-serialize, letting attackers inject executable markup, exploit requires attacker-controlled input.

  • 8.8 /10 High
    CVE-2026-110922 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.84 contains a use after free vulnerability in Prerender, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110921 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.84 contains a use after free vulnerability in V8, caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110919 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.84 contains a use after free vulnerability in V8, caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110915 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.84 contains a use after free vulnerability in Compositing, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-110920 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.84 contains a memory corruption vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-110914 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.84 contains a memory corruption vulnerability in Workers, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110913 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.84 contains a memory corruption vulnerability in DOM, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-95155 No auth

    FasterXML Jackson - Denial of Service

    FasterXML Jackson 1.x including jackson-mapper-asl 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13 contains a denial of service caused by processing deeply nested JSON input in ObjectMapper.readValue, letting attackers cause application crash, exploit requires deserialization of untrusted JSON.