High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 101 of 552
- 7.5 /10 HighCVE-2026-58280 No auth
.NET - Denial of Service
.NET contains an uncontrolled recursion vulnerability that allows unauthorized attackers to cause denial of service over a network, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-58249 No auth
SAP NetWeaver & SAP Web Dispatcher - Denial of Service
SAP NetWeaver and SAP Web Dispatcher contain a denial of service vulnerability caused by improper validation of certain fields in specially crafted requests handled by an internal protocol component, letting unauthenticated attackers crash the affected process remotely, exploit requires no special privileges.
- 8.7 /10 HighCVE-2026-55823 Auth required
Frappe - SQL Injection
Frappe < 16.23.0 contains a SQL injection caused by unsanitized input in get_count() method in reportview, letting attackers alter SQL queries, exploit requires crafted report input.
- 7.3 /10 HighCVE-2026-55601 Auth required
MultiTail - Command Injection
MultiTail <= 7.1.5 contains a command injection caused by insufficient escaping of shell metacharacters in the execute-on-match feature, letting attackers executing commands as the user running MultiTail, exploit requires attacker to control monitored input.
- 8.8 /10 HighCVE-2026-55376 Auth required
Heym - Command Injection
Heym < 0.0.40 contains a sandbox bypass caused by allowed standard-library modules exposing OS, process, and filesystem capabilities in python_tool_executor.py, letting authenticated users execute arbitrary code, exploit requires workflow creation or editing with Agent custom Python tool.
- 7.7 /10 HighCVE-2026-54641 Auth required
OpenRemote - Broken Access Control
OpenRemote < 1.24.2 contains a broken access control caused by improper authorization checks in UserResourceImpl methods, letting realm administrators access other tenants' user data, breaking tenant isolation.
- 7.6 /10 HighCVE-2026-54640 Auth required
OpenRemote - XML External Entity Injection
OpenRemote < 1.24.2 contains an XML external entity injection caused by unsafe external entity resolution in KNXProtocol.startAssetImport method, letting authenticated users read files or cause server-side requests, exploit requires user authentication.
- 8.5 /10 HighCVE-2026-53562 Auth required
Citrix UniconOS - Path Traversal
Citrix UniconOS before 2607 CR and before 2603 LTSR CU2 contains a path traversal caused by improper link resolution before file access, letting attackers access unintended files, exploit requires no special privileges.
- 8.0 /10 HighCVE-2026-53420 Auth required
Zoom Workplace Clients - Privilege Escalation
Zoom Workplace Clients contain a buffer overflow in Zoom Phone feature, letting unauthenticated attackers escalate privileges via network access, exploit requires network access.
- 8.1 /10 HighCVE-2026-53418 Auth required
Zoom Workplace - Broken Access Control
Zoom Workplace for Android < 7.2.1 contains an improper authorization vulnerability in the handler for custom URL scheme, letting unauthenticated attackers escalate privileges via network access.
- 7.8 /10 HighCVE-2026-49785 Auth required
Windows UEFI - Authentication Bypass
Windows UEFI contains an improper resource shutdown or release vulnerability, letting authorized local attackers bypass security features, exploit requires local authorized access.
- 7.0 /10 HighCVE-2026-35001 No auth
OpenS100 - Integer Overflow
OpenS100 contains an integer overflow caused by unvalidated multiplication of grid dimension metadata in S-102 Bathymetric Surface parser, letting remote attackers trigger heap buffer overflow and execute arbitrary code, exploit requires crafted S-102 HDF5 file.
- 8.6 /10 HighCVE-2026-34634 No auth
ColdFusion - Privilege Escalation
ColdFusion contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.
- 7.7 /10 HighCVE-2026-34633 Auth required
ColdFusion - Server-Side Request Forgery
ColdFusion contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.
- 7.2 /10 HighCVE-2026-23707 Auth required
Fortinet FortiAnalyzer & FortiManager - SQL Injection
Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.6, 7.2 all versions, and FortiManager Cloud 7.6.2 through 7.6.4 contain an SQL injection caused by improper neutralization of special elements in SQL commands, letting low privileged users execute arbitrary commands via crafted requests, exploit requires low privileged user access.