High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 128 of 552

  • 8.8 /10 High
    CVE-2026-84313 Auth required

    Nginx UI - Authentication Bypass

    Nginx UI < 2.4.1 contains a broken authentication caused by missing password verification in POST /api/otp_enroll and /api/finish_passkey_register endpoints, letting attackers with stolen JWT bind attacker-controlled TOTP or passkey, exploit requires valid JWT token.

  • 7.1 /10 High
    CVE-2026-84312 No auth

    Nginx UI - Authentication Bypass

    Nginx UI < 2.4.1 contains an authentication bypass caused by improper OAuth state validation in GetCasdoorUri and CasdoorCallback, letting unauthenticated attackers mint sessions for arbitrary identities, exploit requires victim browser interaction.

  • 7.4 /10 High
    CVE-2026-83535 No auth

    OpenStack openstack-network-exporter - Authentication Bypass

    OpenStack openstack-network-exporter contains an information disclosure vulnerability caused by misconfigured or omitted TLS in user authentication, letting adjacent network attackers access sensitive OVS and OVN dataplane metrics without credentials.

  • 8.8 /10 High
    CVE-2026-82108 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-82096 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 7.5 /10 High
    CVE-2026-78673 No auth

    IBM Maximo AI Service - Denial of Service

    IBM Maximo AI Service 9.1.0 and 9.2.0 contain a denial of service caused by improper input validation, letting remote attackers cause service disruption, exploit requires crafted input.

  • 8.7 /10 High
    CVE-2026-78355 Auth required

    OTRS - Path Traversal

    OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X contain a path traversal caused by improper validation in SendSupportBundle functionality, letting authenticated administrators delete files outside intended directories, exploit requires administrative access.

  • 8.8 /10 High
    CVE-2026-77363 No auth

    obsidian-tc - CORS Misconfiguration & Information Disclosure

    obsidian-tc prior to 1.3.1 contains a CORS misconfiguration caused by lack of Host and Origin header validation and missing DNS-rebinding protection in Streamable HTTP transport, letting malicious web pages access local MCP endpoints and vaults when auth.mode is none, exploit requires loopback configuration with auth.mode set to none.

  • 7.7 /10 High
    CVE-2026-75888 Auth required

    OpenShift Console - Server Side Request Forgery

    OpenShift console contains a server side request forgery caused by improper validation of Helm chart URLs, letting authenticated console users make the console pod fetch arbitrary URLs, exploit requires user authentication.

  • 7.5 /10 High
    CVE-2026-75881 No auth

    IBM Maximo Application Suite - IoT Component - Denial of Service

    IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 contain a denial of service caused by an infinite parsing loop when processing certain inputs, letting remote attackers cause service disruption, exploit requires crafted input.

  • 7.8 /10 High
    CVE-2026-75782 Auth required

    IBM Aspera Enterprise WebApps - Privilege Escalation

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 contains a privilege escalation caused by a misconfigured PATH environment variable, letting local attackers gain elevated privileges, exploit requires local access.

  • 7.5 /10 High
    CVE-2026-75095 No auth

    IBM Aspera Enterprise WebApps - Denial of Service

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 contains a denial of service caused by uncontrolled resource consumption, letting remote attackers cause service disruption, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-75061 No auth

    IBM Planning Analytics - Path Traversal

    IBM Planning Analytics 2.0 and 2.1 contain a path traversal caused by specially crafted URL requests with "dot dot" sequences (/../), letting remote attackers write arbitrary files on the system, exploit requires no special privileges.

  • 8.6 /10 High
    CVE-2026-65954 No auth

    PHPCSUtils - Remote Code Execution

    PHPCSUtils 1.0.0-alpha1 to 1.2.3 contains a remote code execution caused by eval() of attacker-controlled array-key expressions in AbstractArrayDeclarationSniff::getActualArrayKey(), letting attackers execute arbitrary commands on the scanning host, exploit requires scanning untrusted PHP code.

  • 8.1 /10 High
    CVE-2026-59977 No auth

    ConvertX - Cross-Site Request Forgery

    ConvertX < 0.18.0 contains a cross-site request forgery caused by use of HTTP GET for deletion without CSRF protection in /delete/{id} endpoint, letting attackers cause unauthorized deletion of converted-file history, exploit requires victim to be authenticated and visit attacker-controlled content.