High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 110 of 552
- 8.8 /10 HighCVE-2026-108385 No auth
dataclasses-avroschema - Insecure Deserialization
dataclasses-avroschema 0.38.0 through 0.70.5 contains an insecure deserialization caused by lack of validation of enum symbols in BaseGenerator.parse_enum and EnumRepresentation.render_symbols, letting attackers inject malicious code into generated enum classes, exploit requires use of generator classes directly.
- 8.8 /10 HighCVE-2026-108384 No auth
dataclasses-avroschema - Remote Code Execution
dataclasses-avroschema 0.38.0 through 0.70.5 contains a remote code execution caused by unsafe interpolation of fixed type aliases in generated Python code, letting attackers execute arbitrary code via crafted schema, exploit requires crafted schema input.
- 8.8 /10 HighCVE-2026-108383 No auth
dataclasses-avroschema - Code Injection
dataclasses-avroschema 0.38.0 through 0.70.5 contains a code injection vulnerability caused by improper validation of enum field defaults in FieldRepresentation.get_field_default, letting attackers inject malicious statements into generated Python modules, exploit requires crafted enum defaults.
- 8.8 /10 HighCVE-2026-108382 No auth
dataclasses-avroschema - Remote Code Execution
dataclasses-avroschema 0.38.0 through 0.70.5 contains a code injection vulnerability caused by unescaped enum symbols in EnumRepresentation.render_symbols, letting attackers inject arbitrary Python code during module import, exploit requires use of generator classes directly.
- 8.8 /10 HighCVE-2026-108381 No auth
dataclasses-avroschema - Remote Code Execution
dataclasses-avroschema 0.44.0 through 0.70.5 contains a code injection vulnerability caused by unsafe evaluation of pydantic-class values in generated field annotations, letting attackers execute arbitrary Python code during module import, exploit requires crafted schema field values.
- 8.8 /10 HighCVE-2026-108380 No auth
dataclasses-avroschema - Template Injection
dataclasses-avroschema 0.65.9 through 0.70.5 contains a template injection caused by unescaped schema field doc values in PydanticFieldRepresentation.add_field_properties, letting attackers execute arbitrary Python code during model generation, exploit requires crafted schema documentation.
- 8.8 /10 HighCVE-2026-108379 No auth
dataclasses-avroschema - Remote Code Execution
dataclasses-avroschema 0.38.0 through 0.70.5 contains a remote code execution caused by unescaped namespace quotes in BaseGenerator.parse_fixed generating unsafe types.confixed annotations, letting attackers execute arbitrary code, exploit requires crafted namespace input.
- 8.8 /10 HighCVE-2026-108378 No auth
dataclasses-avroschema - Code Injection
dataclasses-avroschema 0.40.0 through 0.70.5 contains a code injection vulnerability caused by unescaped docstring rendering in ClassRepresentation.render_docstring, letting attackers execute arbitrary Python code during module import, exploit requires crafted schema doc values.
- 8.8 /10 HighCVE-2026-108377 No auth
dataclasses-avroschema - Code Injection
dataclasses-avroschema 0.62.3 through 0.70.5 contains a code injection vulnerability caused by unescaped schema-controlled Avro record names in generated Python source, letting attackers execute arbitrary code on module import, exploit requires crafted schema name.
- 8.8 /10 HighCVE-2026-108376 No auth
dataclasses-avroschema - Remote Code Execution
dataclasses-avroschema 0.47.3 through 0.70.5 contains a code injection vulnerability caused by unvalidated schema-controlled record names in default_factory lambdas, letting attackers execute arbitrary Python expressions when consuming field defaults, exploit requires crafted record names.
- 8.8 /10 HighCVE-2026-108375 No auth
dataclasses-avroschema - Code Injection
dataclasses-avroschema 0.38.0 through 0.70.5 contains a code injection vulnerability caused by unescaped schema-controlled default values in generated Python source, letting attackers execute arbitrary code on module import, exploit requires crafted schema defaults.
- 7.4 /10 HighCVE-2026-108185 No auth
Zoom Clients - Information Disclosure
Zoom Clients contain an information disclosure vulnerability caused by improper certificate validation in the My Notes feature, letting unauthenticated attackers disclose information via network access, exploit requires network access.
- 7.4 /10 HighCVE-2026-108184 No auth
Zoom - Information Disclosure
Zoom Clients for Windows contain an information disclosure vulnerability caused by improper certificate validation, letting unauthenticated attackers disclose information via network access, exploit requires network access.
- 7.6 /10 HighCVE-2026-108179 Auth required
PluginUs.Net WOLF - SQL Injection
PluginUs.Net WOLF <= 1.1.1 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.
- 7.8 /10 HighCVE-2026-108136 Auth required
Microsoft Windows Search Component - Privilege Escalation
Microsoft Windows Search Component contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory management flaws.