High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 99 of 552
- 8.6 /10 HighCVE-2026-65170 No auth
NVIDIA AIStore - Server Side Request Forgery
NVIDIA AIStore for Linux contains a server side request forgery caused by crafted original URL in experimental HT backend, letting unauthenticated remote attackers disclose information, exploit requires crafted URL.
- 8.1 /10 HighCVE-2026-65164 No auth
NVIDIA AIStore - Path Traversal
NVIDIA AIStore for Linux contains a path traversal caused by improper limitation of pathname in dSort archive extraction, letting remote attackers create or overwrite files, execute code, disclose information, tamper data, and cause denial of service, exploit requires crafted archive member names.
- 7.5 /10 HighCVE-2026-65161 No auth
NVIDIA AIStore - Information Disclosure
NVIDIA AIStore for Linux contains an information disclosure vulnerability caused by improper validation in the Promote API, letting unauthenticated remote attackers read files accessible to the target process by supplying a crafted absolute source path.
- 7.3 /10 HighCVE-2026-65150 Auth required
NVIDIA DALI - Out of Bounds Read
NVIDIA DALI contains an out-of-bounds read vulnerability caused by uncontrolled memory access, letting attackers cause information disclosure, data tampering, and denial of service, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-65149 Auth required
NVIDIA DALI - Out of Bounds Write
NVIDIA DALI contains an out-of-bounds write vulnerability caused by uncontrolled memory access, letting attackers cause denial of service, information disclosure, and data tampering, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-65148 Auth required
NVIDIA DALI - Buffer Overflow
NVIDIA DALI contains a stack-based buffer overflow vulnerability, letting attackers execute code, disclose information, tamper data, or cause denial of service, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-65147 Auth required
NVIDIA DALI - Out of Bounds Read
NVIDIA DALI contains an out-of-bounds read vulnerability caused by uncontrolled memory access, letting attackers cause information disclosure and denial of service, exploit requires crafted input.
- 7.8 /10 HighCVE-2026-65141 No auth
NVIDIA Isaac Lab - Expression Language Injection
NVIDIA Isaac Lab contains an expression language injection caused by eval injection, letting attackers execute code, disclose information, tamper data, and cause denial of service, exploit requires crafted input.
- 7.8 /10 HighCVE-2026-65110 Auth required
NVIDIA Megatron-LM - Remote Code Execution
NVIDIA Megatron-LM contains a remote code execution caused by loading a maliciously crafted checkpoint file, letting attackers execute code, escalate privileges, disclose information, and tamper data, exploit requires user to load crafted file.
- 7.1 /10 HighCVE-2026-65104 Auth required
NVIDIA Megatron-LM - Data Tampering & Information Disclosure
NVIDIA Megatron-LM contains a hash collision vulnerability in the inference cache, letting attackers cause data tampering and partial information disclosure, exploit requires crafted inference requests.
- 8.1 /10 HighCVE-2026-65103 No auth
NVIDIA AIStore - Path Traversal
NVIDIA AIStore for Linux contains a path traversal caused by improper limitation of pathname in the target-side object rename handler, letting unauthenticated remote attackers create or overwrite arbitrary files, exploit requires crafted rename destination.
- 8.6 /10 HighCVE-2026-65101 No auth
NVIDIA AIStore - Server Side Request Forgery
NVIDIA AIStore for Linux contains a server side request forgery caused by supplying a crafted external key map URL in the distributed sort component, letting attackers cause information disclosure, exploit requires crafted URL input.
- 8.7 /10 HighCVE-2026-63316 Auth required
Payload CMS - SQL Injection
Payload CMS contains a sql injection caused by improper neutralization of user input in "in" and "not_in" query parameters, letting authenticated attackers execute arbitrary SQL commands.
- 8.1 /10 HighCVE-2026-63174 Auth required
Omnispace Agora Project - Broken Access Control
Omnispace Agora Project < 26.10.0 contains a broken access control vulnerability caused by missing readRight() check in spaceAffectList affectation, letting space administrators manipulate user-space assignments outside their authority, exploit requires space administrator privileges.
- 7.1 /10 HighCVE-2026-63172 Auth required
Omnispace Agora Project - Broken Access Control
Omnispace Agora Project < 26.10.0 contains a broken access control vulnerability caused by missing function-level authorization check in actionVueEditUser, letting non-administrative users create unauthorized accounts, exploit requires user authentication.