High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 118 of 552
- 7.5 /10 HighCVE-2026-103030 No auth
Dio - Broken Access Control
Dio 1.0.0 to 2.8.0 contains a broken access control caused by Http2Adapter._fetch copying original headers on cross-origin redirects without origin checks, letting attackers receive sensitive headers on redirected requests, exploit requires use of Http2Adapter with redirects enabled.
- 8.5 /10 HighCVE-2026-102982 Auth required
Plane - Stored XSS
Plane < 1.4.0 contains a stored XSS caused by failure to sanitize unsafe URL schemes in comment_html, letting project members execute attacker-controlled scripts in other users' browsers, exploit requires crafted comment link.
- 8.8 /10 HighCVE-2026-102870 No auth
ASP.NET Core - Command Injection
ASP.NET Core contains a code injection vulnerability caused by improper control of code generation, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102869 No auth
.NET & Visual Studio - Privilege Escalation
.NET and Visual Studio contain a type confusion vulnerability caused by access of resource using incompatible type, letting unauthorized attackers elevate privileges over a network, exploit requires network access.
- 8.1 /10 HighCVE-2026-102866 No auth
Microsoft Office SharePoint - Authentication Bypass
Microsoft Office SharePoint contains a broken authentication caused by improper verification of cryptographic signature, letting unauthorized attackers elevate privileges over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-102863 Auth required
Microsoft Office SharePoint - Command Injection
Microsoft Office SharePoint contains a code injection caused by improper control of code generation, letting authorized attackers elevate privileges over a network, exploit requires attacker authorization.
- 8.8 /10 HighCVE-2026-102862 Auth required
Microsoft Office SharePoint - Broken Access Control
Microsoft Office SharePoint contains a broken access control caused by incorrect authorization, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-102861 Auth required
Microsoft Office SharePoint - Privilege Escalation
Microsoft Office SharePoint contains a broken access control caused by missing authorization checks, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-102860 Auth required
Microsoft Office SharePoint - Privilege Escalation
Microsoft Office SharePoint contains a broken access control vulnerability caused by improper access control, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-102858 No auth
Microsoft Office OneNote - Remote Code Execution
Microsoft Office OneNote contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102857 No auth
Microsoft Office Visio - Remote Code Execution
Microsoft Office Visio contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102856 No auth
Microsoft Office Visio - Remote Code Execution
Microsoft Office Visio contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102855 No auth
Microsoft Office Visio - Remote Code Execution
Microsoft Office Visio contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102850 No auth
Microsoft Office Access - Remote Code Execution
Microsoft Office Access contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102849 No auth
Microsoft Office Access - Remote Code Execution
Microsoft Office Access contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.