High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 8 of 552

  • 8.2 /10 High
    CVE-2026-105034 No auth

    EnergizeLab Eilik NestJS - Authentication Bypass

    EnergizeLab Eilik NestJS auth service contains an authentication bypass caused by issuing device tokens for arbitrary robot serial numbers without authentication, letting unauthenticated remote attackers act as any device against cloud services.

  • 8.2 /10 High
    CVE-2026-111282 No auth

    Driftregion iso14229 - Integer Overflow

    Driftregion iso14229 < 0.10.1 contains an integer overflow caused by improper file path length check in Handle_0x38_RequestFileTransfer, letting unauthenticated attackers cause crashes or memory disclosure via crafted RequestFileTransfer requests.

  • 7.5 /10 High
    CVE-2026-111279 No auth

    Dragonfly - Denial of Service

    Dragonfly 2.0.2 contains an unbounded memory allocation vulnerability caused by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER, or SRANDMEMBER commands, letting unauthenticated clients cause denial of service by exhausting memory.

  • 8.6 /10 High
    CVE-2026-55103 No auth

    Discourse ActivityPub - Broken Access Control

    Discourse ActivityPub prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5 contains a broken access control vulnerability caused by insufficient verification of actor identity and ownership in inbound ActivityPub processing, letting remote attackers edit, delete, or reply to federated posts without permissions, exploit requires crafted signed requests.

  • 7.1 /10 High
    CVE-2026-9703 Auth required

    Grafana - Broken Access Control

    Grafana contains a broken access control vulnerability in its data source proxy forwarding write requests to Loki data sources, letting authenticated Viewer users create, modify, and delete Loki alerting rules, affecting all users of the Loki data source.

  • 7.5 /10 High
    CVE-2026-96537 No auth

    Tutor LMS - Broken Access Control

    Tutor LMS WordPress plugin < 4.1.1 contains a broken access control vulnerability caused by missing capability checks in page regeneration routine, letting unauthenticated users force-publish, overwrite, create pages, and modify options.

  • 8.6 /10 High
    CVE-2026-93484 Auth required

    Znuny - SQL Injection

    Znuny through 7.3.6 contains a SQL injection caused by direct concatenation of unsanitized ContentSearch parameter in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB, letting attackers execute arbitrary SQL commands, exploit requires crafted input with ContentSearch parameter.

  • 8.2 /10 High
    CVE-2026-88794 No auth

    Enterprise Architect - XML External Entity Injection

    Enterprise Architect 17.1 contains an XML External Entity (XXE) injection caused by processing external entities in the XSLT Debugger when loading crafted XML files, letting attackers read arbitrary files, exploit requires crafted XML input.

  • 7.2 /10 High
    CVE-2026-88043 No auth

    Mang Board WP - Stored XSS

    Mang Board WP plugin for WordPress <= 2.4.0 contains a stored XSS caused by insufficient input sanitization and output escaping in the 'data_type' parameter, letting unauthenticated attackers execute arbitrary scripts on user page access.

  • 8.8 /10 High
    CVE-2026-81534 Auth required

    Email Customizer for WooCommerce (Pro) - Remote Code Execution

    Email Customizer for WooCommerce (Pro) <= 3.9.5 contains a remote code execution caused by insufficient authorization and input sanitization in send_test_mail() function, letting authenticated attackers with subscriber access execute arbitrary PHP code, exploit requires subscriber-level access.

  • 7.3 /10 High
    CVE-2026-79840 Auth required

    HPE NonStop XABroker - Buffer Overflow

    HPE NonStop XABroker contains a buffer overflow caused by improper memory handling, letting attackers cause memory corruption and application crash, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-79839 Auth required

    HPE NonStop ODBC/MX Server - Buffer Overflow

    HPE NonStop ODBC/MX Server contains a buffer overflow caused by improper memory handling, letting attackers cause memory corruption and application crash, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-79838 Auth required

    HPE NonStop ODBC/MX Services - Buffer Overflow

    HPE NonStop ODBC/MX Services contains a buffer overflow caused by improper memory handling, letting attackers cause memory corruption and application crash, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-79837 Auth required

    HPE NonStop SQL/MX UDR SERVER - Denial of Service

    HPE NonStop SQL/MX UDR SERVER contains a vulnerability caused by crafted messages that can cause process termination, service disruption, or memory corruption, letting attackers disrupt service, exploit requires crafted message.

  • 7.4 /10 High
    CVE-2026-79834 Auth required

    HPE NonStop SQL/MX SQLCAT - Command Injection

    HPE NonStop SQL/MX SQLCAT contains a command injection vulnerability allowing unauthenticated users to execute unauthorized commands remotely, exploit requires no special privileges.