High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 102 of 552
- 7.2 /10 HighCVE-2026-23705 Auth required
Fortinet FortiAnalyzer & FortiManager - SQL Injection
Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions and FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.6, 7.2 all versions contain an SQL injection caused by improper neutralization of special elements in SQL commands, letting low privileged users execute arbitrary commands via crafted requests.
- 7.1 /10 HighCVE-2026-18228 Auth required
HyperScale - Path Traversal
HyperScale contains a path traversal caused by improper input validation, letting attackers disclose sensitive information, exploit requires no special privileges.
- 8.5 /10 HighCVE-2026-16301 Auth required
GitLab CE/EE - Broken Access Control
GitLab CE/EE >= 18.7 and < 19.2.8, 19.3 and < 19.3.5, 19.4 and < 19.4.2 contain a broken access control caused by improper authorization checks in downstream pipeline creation service, letting authenticated Developer role users execute CI/CD pipelines on protected branches without authorization.
- 8.2 /10 HighCVE-2026-14814
GitLab CE/EE - Broken Access Control
GitLab CE/EE < 19.2.8, 19.3 < 19.3.5, and 19.4 < 19.4.2 contain a cache poisoning vulnerability caused by improper validation of repository references, letting users poison cached raw repository files causing CI/CD pipelines to execute crafted content and expose protected environment variables, exploit requires specific repository conditions.
- 8.6 /10 HighCVE-2026-13138 No auth
Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform - Broken Access Control
Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform through 2026-07-23 contains a broken access control caused by client-side enforcement of server-side security, letting attackers manipulate state remotely, exploit requires no special privileges.
- 8.7 /10 HighCVE-2026-12656 No auth
Affected product - Denial of Service
Affected product contains a denial-of-service caused by improper handling of network storm traffic, letting attackers interrupt communication and cause device faults, exploit requires network access.
- 8.8 /10 HighCVE-2026-12655 No auth
1732E ArmorBlock® I/O - Authentication Bypass
1732E ArmorBlock® I/O contains an authentication bypass caused by lack of credential validation in the webserver password change functionality, letting unauthenticated attackers take over admin accounts or modify device configuration, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-11732 No auth
NETGEAR Router - Command Injection
NETGEAR routers with Block Sites feature enabled contain a command injection caused by insufficient input validation in the website blocking feature, letting network-adjacent attackers with network access run unauthorized commands.
- 8.8 /10 HighCVE-2026-11731 No auth
NETGEAR RAX - Authentication Bypass
NETGEAR RAX series contains an authentication bypass caused by improper access control in the management service, letting unauthenticated adjacent attackers access or modify administrative settings, exploit requires adjacent network access.
- 8.5 /10 HighCVE-2026-110255 Auth required
Finsys Dockhand - Server-Side Request Forgery
Finsys Dockhand < 1.0.43 contains a server-side request forgery caused by improper validation of repository URL and stackfile values, letting authenticated users fetch arbitrary URLs and read sensitive internal data.
- 8.8 /10 HighCVE-2026-110238 Auth required
Rapyd Admin - Authorization Bypass
Rapyd Admin 9.0.0 < 9.20.0 contains an authorization bypass caused by predictable sequential user IDs in UsersModalEditEmbed Livewire component, letting authenticated company members with default customer role modify or delete arbitrary user accounts, exploit requires authenticated company member with default customer role.
- 7.3 /10 HighCVE-2026-110237 Auth required
Vifm - Command Injection
Vifm 0.8.1-beta through 0.14.4 contains a command injection caused by reuse of a pre-existing IPC FIFO without ownership checks, letting local attackers execute commands as another user, exploit requires local access.
- 7.0 /10 HighCVE-2026-110236 No auth
KDE Dolphin - Command Injection
KDE Dolphin 24.08.0 through 26.08.2 contains a command injection caused by crafted folder names substituted into the {path} placeholder in slotDoubleClickViewBackground, letting attackers execute OS commands when victims double-click the view background, exploit requires victim interaction.
- 7.8 /10 HighCVE-2026-110233 No auth
Rovr - Command Injection
Rovr <= 0.10.3 on Windows contains a command injection caused by processing malicious file names with shell metacharacters in open_file, letting attackers execute OS commands with user privileges, exploit requires opening the crafted file.
- 7.1 /10 HighCVE-2026-110220 Auth required
Kubeflow Model Registry - Server-Side Request Forgery
Kubeflow Model Registry <= 0.3.17 contains a server-side request forgery caused by improper validation of the modelregistry.kubeflow.org/url annotation, letting namespace users steal controller ServiceAccount tokens and modify other tenants' InferenceServices cluster-wide, exploit requires namespace user privileges.