High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 10 of 725
- 8.1 /10 HighCVE-2026-119733 Auth required
Munshi by Petpooja - Broken Access Control
Munshi by Petpooja before 2026-07-07 contains a broken access control caused by missing authorization checks in company deletion workflow at DELETE /api/companies/{company_id}, letting authenticated invited sub-users hard delete company records, exploit requires authenticated sub-user access to the company.
- 7.5 /10 HighCVE-2026-119731 No auth
Munshi (by Petpooja) - Authentication Bypass
Munshi (by Petpooja) before 2026-06-30 contains a payment bypass vulnerability caused by lack of webhook authentication and verification in subscription payment webhook at POST /api/payment/order/webhook, letting remote unauthenticated attackers mark subscriptions as paid without actual payment, exploit requires attacker to submit forged payment-success notifications referencing valid orders.
- 7.9 /10 HighCVE-2026-119301 Auth required
AWS SDK for pandas - SQL Injection
AWS SDK for pandas (awswrangler) 3.5.2 through 3.17.0 contains a SQL injection caused by improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component, letting authenticated remote users with permission to modify AWS Glue Data Catalog metadata read and write tables accessible by more privileged principals, exploit requires authenticated user with metadata modification permissions.
- 8.8 /10 HighCVE-2026-119085 Auth required
Amazon Virtual Engineering Workbench - Template Injection
Amazon Virtual Engineering Workbench contains a template injection caused by improper neutralization of special elements in the publishing component, letting remote authenticated attackers execute arbitrary code with publishing Lambda's IAM role permissions, exploit requires authentication.
- 8.2 /10 HighCVE-2026-117518 No auth
@fastify/reply-from - Path Traversal
@fastify/reply-from <= 12.8.0 contains a path traversal caused by improper validation of backslash dot-segments in proxy paths, letting unauthenticated attackers access unintended upstream resources, exploit requires crafted path with backslash dot-segments.
- 7.1 /10 HighCVE-2026-116768 Auth required
Secure Access - Denial of Service
Secure Access servers < 14.61 contain a denial of service caused by missing length validation, letting authenticated attackers cause persistent service disruption when connecting for the first time.
- 7.1 /10 HighCVE-2026-116767 Auth required
Secure Access - Denial of Service
Secure Access servers < 14.61 contain an improper input handling vulnerability, letting authenticated attackers cause persistent denial of service, exploit requires authentication.
- 8.3 /10 HighCVE-2026-116766 Auth required
Secure Access server - Denial of Service
Secure Access server >= 13.0 and < 14.61 contains an improper input handling vulnerability, letting attackers cause persistent denial of service, exploit requires crafted input.
- 7.0 /10 HighCVE-2026-115653 Auth required
Eclipse ThreadX - Memory Corruption
Eclipse ThreadX 6.0.1 through 6.5.2.202603 contains a memory corruption vulnerability caused by unchecked stack pointer usage in the PendSV handler of Cortex-M module ports, letting user-mode memory-protected modules read and write adjacent memory regions, exploit requires user-mode memory-protected module.
- 8.2 /10 HighCVE-2026-115403 No auth
Eclipse ThreadX NetX Duo - Denial of Service
Eclipse ThreadX NetX Duo 6.0 through 6.5.2.202603a contains a denial of service caused by unchecked destination-table entry addition in IPv6 raw send path, letting remote attackers crash the sending thread via crafted packets, exploit requires network access.
- 8.7 /10 HighCVE-2026-115215 No auth
Eclipse ThreadX NetX Duo - Denial of Service
Eclipse ThreadX NetX Duo 6.0 through 6.5.2.202603a contains a denial of service caused by fixed session pool exhaustion in NetX Secure DTLS server due to unreleased sessions from stalled handshakes, letting remote unauthenticated attackers deny service, exploit requires sending spoofed datagrams.
- 8.7 /10 HighCVE-2026-114408
Eclipse ThreadX NetX Duo - Denial of Service
Eclipse ThreadX NetX Duo 6.4.5.202504 through 6.5.2.202603a contains a denial of service caused by improper handling of ICMPv6 Packet Too Big messages in the destination table, letting network attackers crash the IP helper thread, exploit requires IPv6 path MTU discovery enabled.
- 8.6 /10 HighCVE-2026-111560 Auth required
Barracuda Appliance - Command Injection
Barracuda appliance products contain a command injection caused by improper neutralization of shell metacharacters in the timezone configuration field, letting authenticated administrators execute OS commands with root privileges, exploit requires administrator authentication.
- 8.4 /10 HighCVE-2026-111048 Auth required
FOSSBilling - Stored XSS
FOSSBilling 0.1.0 to 0.8.9 contains a stored XSS caused by unsanitized note parameter stored in support_ticket_note and rendered via innerHTML in admin ticket list, letting staff users with support.manage_tickets permission execute scripts with viewer's privileges, exploit requires staff user permission.
- 8.4 /10 HighCVE-2026-109142
Krill - Broken Access Control
Krill contains a broken access control vulnerability caused by in-process RFC 6492 provisioning exchange trusting unverified child identity, letting attackers impersonate child CAs, exploit requires parent and child CAs on the same server.