High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 132 of 552
- 8.7 /10 HighCVE-2026-109558 Auth required
EdgeEver - Stored XSS
EdgeEver 1.6.0 through 1.112.0 contains a stored XSS caused by rendering template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization in TemplatesPane.tsx, letting attackers run scripts and access privileged bridge, exploit requires API or MCP token access.
- 8.7 /10 HighCVE-2026-109557 Auth required
EdgeEver - Stored XSS
EdgeEver through 1.112.0 contains a stored XSS caused by injection through notebook names or memo titles in setMemoDragPreview, letting attackers execute scripts with access to desktop bridge session token, exploit requires attacker to set malicious names.
- 8.0 /10 HighCVE-2026-109556 Auth required
EdgeEver Desktop - Remote Code Execution
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability caused by lack of sender check in desktop:acp-probe IPC handler, letting attackers with script execution launch local executables with user privileges, exploit requires script execution in renderer.
- 7.5 /10 HighCVE-2026-109426
Telegram-Stremio - Authentication Bypass
Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability caused by reversible encoding of Telegram session strings without encryption, letting attackers with database or backup access recover authenticated sessions, exploit requires access to MongoDB database, backups, or logs.
- 7.4 /10 HighCVE-2026-109423
NetEase Cloud Music - Man-in-the-Middle
NetEase Cloud Music client for Windows 3.1.38 and 3.1.39.205426 contains a man-in-the-middle vulnerability caused by improper TLS certificate validation, letting network-adjacent attackers intercept and modify HTTPS traffic, exploit requires network adjacency.
- 8.1 /10 HighCVE-2026-109422
NetEase Cloud Music - Remote Code Execution
NetEase Cloud Music client for Windows 3.1.38 and 3.1.39.205426 contains a remote code execution caused by unvalidated URL scheme in renderer-process IPC bridge os.navigateExternal, letting attackers execute arbitrary local binaries under the logged-in user's account, exploit requires injecting content into the renderer via forged API response.
- 8.1 /10 HighCVE-2026-109399
SWUpdate - Authentication Bypass
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability caused by trusting untrusted X.509 certificates embedded in CMS SignedData, letting attackers with a sibling intermediate signing key install malicious updates, exploit requires attacker to hold a signing key from a sibling intermediate.
- 7.5 /10 HighCVE-2026-109398 No auth
Gumlet php-image-resize - Denial of Service
Gumlet php-image-resize < 3.0.1 contains a denial of service caused by lack of pixel limits in ImageResize constructor passing images to GD imagecreatefrom* functions, letting remote attackers exhaust PHP memory, exploit requires image upload.
- 7.2 /10 HighCVE-2026-109397 Auth required
Thelia - Unrestricted File Upload
Thelia < 3.1.2 and 3.2.x < 3.2.1 contain an unrestricted file upload vulnerability caused by inconsistent filename sanitization in FileProcessorService and FileManager::sanitizeFileName(), letting authenticated back-office users upload executable PHP files for code execution as the web server user.
- 7.4 /10 HighCVE-2026-109394 No auth
Thirty bees - Authentication Bypass
Thirty bees through 1.7.0 contains an authentication bypass caused by PasswordController::resolveCustomer() allowing unauthenticated attackers to reset registered customers' passwords using guest account tokens when guest checkout is enabled.
- 8.1 /10 HighCVE-2026-109391 No auth
Square Squash - Insecure Deserialization
Square Squash contains an insecure deserialization vulnerability caused by unsafe YAML.load usage in the /api/1.0/symbolication endpoint, letting unauthenticated attackers execute arbitrary code remotely, exploit requires crafted YAML payload.
- 7.5 /10 HighCVE-2026-109380 No auth
modern-tar - Denial of Service
modern-tar 0.3.5 through 0.8.5 contains a denial of service caused by memory exhaustion via negative entry sizes from non-octal bytes in readOctal(), letting attackers exhaust process memory by supplying crafted archives, exploit requires crafted archive input.
- 8.1 /10 HighCVE-2026-109373 No auth
ZITADEL - Authentication Bypass
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass caused by forging unsigned session cookies in the Login V2 UI, letting unauthenticated attackers obtain other users' session tokens and take over accounts, exploit requires no authentication.
- 8.7 /10 HighCVE-2026-109372 Auth required
ZITADEL - Authentication Bypass
ZITADEL 4.x < 4.19.2 and 3.x <= 3.4.15 contain an authentication bypass caused by improper assertion signature verification in the SAML identity-provider intent callback, letting attackers with organization-administrator permission authenticate as any user linked to another SAML provider, exploit requires organization-administrator privileges.
- 8.2 /10 HighCVE-2026-109371 No auth
ZITADEL - Authentication Bypass
ZITADEL < 4.18.0 contains a broken authentication vulnerability caused by the change-username handler acting on accounts before factor verification in hosted Login V1 UI, letting unauthenticated attackers rename active users including administrators.