High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 127 of 552
- 8.6 /10 HighCVE-2026-85954 No auth
Progress MarkLogic Server - Privilege Escalation
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a privilege escalation caused by evaluation of user-controlled values in higher-order XQuery functions in elevated security context, letting attackers escalate privileges beyond granted permissions.
- 8.5 /10 HighCVE-2026-85953 Auth required
Progress MarkLogic Server - Broken Access Control
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a broken access control vulnerability caused by insufficient validation of user-controlled file paths and user-context values in privileged legacy InfoStudio modules, letting attackers gain unauthorized file access or execute under unintended identities, exploit requires user interaction with vulnerable modules.
- 8.5 /10 HighCVE-2026-85952 Auth required
Progress MarkLogic Server - Server-Side Request Forgery
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a server-side request forgery caused by improper validation of requests, letting authenticated attackers access internal cloud services and potentially unauthorized cloud credentials.
- 8.5 /10 HighCVE-2026-85951 Auth required
Progress MarkLogic Server - Server-Side Request Forgery
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 on Azure contain a server-side request forgery caused by improper validation of internal requests, letting authenticated attackers access internal cloud services, exploit requires authentication.
- 8.4 /10 HighCVE-2026-85950 Auth required
Progress MarkLogic Server - Broken Access Control
Progress MarkLogic Server < 12.1.0 and < 11.3.7 contain an authorization flaw caused by improper access control, letting remote attackers with administrative privileges access authentication material of higher-privileged users, exploit requires administrative privileges.
- 8.1 /10 HighCVE-2026-85949 Auth required
Progress MarkLogic Server - Information Disclosure
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain an information disclosure vulnerability caused by recording security-sensitive information in diagnostic logs under certain configurations, letting attackers with log access obtain unauthorized access.
- 8.1 /10 HighCVE-2026-85457 Auth required
IBM Planning Analytics - Remote Code Execution
IBM Planning Analytics 2.0 and 2.1 contain a stack-based buffer overflow caused by improper handling of input, letting remote authenticated attackers execute arbitrary code.
- 7.4 /10 HighCVE-2026-84418
IBM DataStage - Man-in-the-Middle
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a man-in-the-middle vulnerability caused by acceptance of forged TLS certificates in client-side SDK, letting attackers intercept authorization tokens and access tenant APIs, exploit requires network interception.
- 8.1 /10 HighCVE-2026-84360 Auth required
Nginx UI - Broken Access Control
Nginx UI < 2.4.1 contains a broken access control caused by insufficient authentication on /mcp and /mcp_message routes, letting OTP-enabled users with normal JWT modify Nginx configuration and trigger reload, exploit bypasses step-up control.
- 8.3 /10 HighCVE-2026-84319 Auth required
Nginx UI - Command Injection
Nginx UI < 2.4.1 contains a command injection caused by MCP configuration interface allowing secondary authenticated users to load restricted modules and execute attacker-controlled JavaScript, letting attackers execute code in Nginx worker context, exploit requires secondary user authentication.
- 8.8 /10 HighCVE-2026-84318 Auth required
Nginx UI - Remote Code Execution
Nginx UI 2.0.0-rc.6 to 2.4.1 contains a remote code execution caused by missing config validation in MCP tool nginx_config_add, letting authenticated attackers execute code by writing dangerous config directives.
- 8.8 /10 HighCVE-2026-84317 Auth required
Nginx UI - Command Injection
Nginx UI < 2.4.1 contains a command injection caused by lack of validation in MCP tool nginx_config_add allowing authenticated MCP callers to inject dangerous directives, letting attackers execute code via njs/perl modules.
- 8.8 /10 HighCVE-2026-84316 Auth required
Nginx UI - Command Injection
Nginx UI < 2.4.1 contains a command injection caused by improper validation of multiple semicolon-separated directives in configuration, letting authenticated users execute code in Nginx worker context, exploit requires authentication.
- 8.3 /10 HighCVE-2026-84315 Auth required
Nginx UI - Broken Access Control
Nginx UI < 2.4.1 contains a broken access control caused by missing RequireSecureSession enforcement on multiple authenticated mutation routes, letting attackers with stolen authenticated sessions bypass OTP/passkey step-up to modify sensitive settings.
- 8.7 /10 HighCVE-2026-84314 Auth required
Nginx UI - Broken Access Control
Nginx UI < 2.4.1 contains a broken access control vulnerability caused by missing RequireSecureSession enforcement in POST /api/users/:id endpoint, letting authenticated users change other users' passwords, exploit requires authentication.