High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 133 of 552
- 7.5 /10 HighCVE-2026-109363 No auth
ZcashFoundation Zebra - Denial of Service
ZcashFoundation Zebra < 6.4.2 contains a denial of service caused by improper error handling during UnminedTx construction with pre-NU6.3 consensus branch ID transactions, letting unauthenticated peers crash the node remotely, exploit requires sending a crafted pre-handshake tx message.
- 7.3 /10 HighCVE-2026-109361
MONAI - Insecure Deserialization
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability caused by unpickling the postprocessing_file path from inference_information.json without confinement, letting attackers who can modify this file execute code remotely, exploit requires attacker to modify inference_information.json.
- 7.5 /10 HighCVE-2026-109360
MONAI - Remote Code Execution
MONAI < 1.6.1 contains a remote code execution vulnerability caused by untrusted deserialization of SENet pretrained weights fetched over plaintext HTTP, letting on-path attackers execute arbitrary code, exploit requires attacker to tamper with network traffic.
- 7.7 /10 HighCVE-2026-109359 Auth required
Contrast - Authentication Bypass
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation, letting attackers with write access to manifest history replay superseded history or disclose Mesh CA key, exploit requires write access to manifest history or secret seed.
- 7.8 /10 HighCVE-2026-109358 Auth required
Edgeless Systems Contrast - Privilege Escalation
Edgeless Systems Contrast >1.8.0 <1.24.1 contains an incorrect permissions vulnerability caused by the node installer writing containerd config with world-writable permissions, letting local unprivileged users escalate privileges by modifying config, exploit requires local access.
- 8.1 /10 HighCVE-2026-109357
LibreNMS - Authentication Bypass
LibreNMS < 26.9.0 contains an LDAP injection caused by unescaped usernames in LDAP search filters in ldap-authorization and ad-authorization modes, letting unauthenticated attackers gain admin access via wildcard username, exploit requires REMOTE_USER not forwarded.
- 7.1 /10 HighCVE-2026-109353 Auth required
LibreNMS - SQL Injection
LibreNMS < 26.9.0 contains an SQL injection caused by unsanitized array-valued notification_id parameter in notifications.inc.php, letting unprivileged users read users.password hashes via cross-table queries, exploit requires unprivileged user access.
- 7.2 /10 HighCVE-2026-109347 Auth required
Adminer - Remote Code Execution
Adminer < 6.1.1 contains a remote code execution caused by bypassing ATTACH and VACUUM INTO restrictions using UTF-8 byte-order mark prefix in SQLite statements, letting authenticated users execute code as the web server user.
- 8.1 /10 HighCVE-2026-109346 No auth
better-auth - Authentication Bypass
better-auth > 1.3.8-beta.3 < 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin caused by omission of client_id and scope in GET /device, letting attackers trick signed-in users into approving device codes, exploit requires user interaction.
- 8.1 /10 HighCVE-2026-109343 Auth required
SurrealDB - Broken Access Control
SurrealDB < 3.3.0 contains a broken access control vulnerability caused by the SurrealQL USE statement allowing session switching to any namespace/database without proper permission checks, letting authenticated users access and modify other tenants' data, exploit requires authenticated user privileges.
- 7.1 /10 HighCVE-2026-109341 Auth required
SurrealDB - Authorization Bypass
SurrealDB < 3.3.0 contains an authorization bypass caused by resolving JSON Patch pointers against unreduced records, letting attackers with table-level write permission read SELECT-restricted fields, exploit requires table-level write permission.
- 8.1 /10 HighCVE-2026-109334 Auth required
SurrealDB - Broken Access Control
SurrealDB < 3.3.0 contains a broken access control vulnerability caused by lack of verification of caller-selected namespace or database against authenticated user level, letting authenticated attackers access other tenants' data, exploit requires authentication.
- 7.4 /10 HighCVE-2026-109331 No auth
Network-AI - Security Control Bypass
Network-AI 5.14.0 < 5.15.2 contains a security control bypass caused by incomplete deny pattern matching in ClaudeHookBridge PreToolUse hook, letting prompt-injected agents write web shells or execute scripts, exploit requires crafted input with multiple fields.
- 7.5 /10 HighCVE-2026-109326 No auth
Grav - Information Disclosure
Grav < 2.1.7 contains an information disclosure vulnerability caused by insufficient blocking of .git directories in nested paths in bundled web server configurations, letting unauthenticated attackers retrieve Git repository data, exploit requires unauthenticated access.
- 7.5 /10 HighCVE-2026-109325
Grav - Authentication Bypass
Grav 2.0.22 < 2.1.7 contains an authentication bypass caused by trusting loopback REMOTE_ADDR values in the Clockwork profiler, letting unauthenticated attackers behind same-host HTTP proxy read sensitive profiler data, exploit requires attacker behind same-host HTTP proxy.