High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 134 of 552
- 8.8 /10 HighCVE-2026-109318 Auth required
Grav Git Sync - Command Injection
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection caused by shell substitutions in profile fields reaching PHP exec() via git commit --author, letting authenticated content editors execute OS commands as the web-server account.
- 7.2 /10 HighCVE-2026-109317 Auth required
Grav grav-plugin-api - Privilege Escalation
Grav grav-plugin-api < 1.0.36 contains a privilege escalation caused by storing positive scalar admin or API parent grants, letting delegated user managers obtain super-admin access, exploit requires api.users.write permission.
- 7.3 /10 HighCVE-2026-109314 Auth required
Grav Login - Information Disclosure & Broken Access Control
Grav Login plugin < 3.9.9 contains an information disclosure vulnerability caused by authoring a page at the reset route, letting publishers obtain password-reset tokens and usernames, exploit requires publisher privileges.
- 8.1 /10 HighCVE-2026-109313 Auth required
Grav Login plugin - Authentication Bypass
Grav Login plugin < 3.9.9 contains an authentication bypass caused by remember-me cookie restoration, letting attackers with valid password skip two-factor authentication, exploit requires valid password.
- 8.1 /10 HighCVE-2026-109312 Auth required
Grav Login plugin - Authentication Bypass
Grav Login plugin > 2.7.0 < 3.9.9 contains an authentication bypass caused by incomplete verification of pending front-end 2FA sessions in processUserProfile(), letting attackers with victim's password disable 2FA and take over accounts, exploit requires ability to publish page form without access rule.
- 8.8 /10 HighCVE-2026-109308 Auth required
Craft CMS - Remote Code Execution
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains a remote code execution caused by passing raw 'updates' parameter without cleansing in AppController::actionCacheUpdates, letting authenticated control panel users with performUpdates permission or Updates-utility access execute arbitrary code via behavior and event-handler injection.
- 8.8 /10 HighCVE-2026-109305 Auth required
Craft CMS - Template Injection
Craft CMS > 5.10.2 < 5.10.14 contains a template injection caused by a Twig sandbox bypass allowing non-admin users with System Messages permission to invoke PHP callables, letting them execute code as the web user.
- 7.3 /10 HighCVE-2026-109291 Auth required
Open WebUI - Stored XSS
Open WebUI > 0.6.33 < 0.11.4 contains a stored XSS caused by storing javascript: URLs in citation embed_url fields, letting authenticated attackers execute scripts in victims' sessions and steal tokens, exploit requires user authentication.
- 7.3 /10 HighCVE-2026-109290 Auth required
Open WebUI - Stored XSS
Open WebUI >0.11.1 <0.11.4 contains a stored cross-site scripting caused by crafted DOCX attachments in DocxPreview.svelte, letting authenticated attackers execute scripts to steal admin session tokens.
- 8.1 /10 HighCVE-2026-109286 No auth
Open WebUI - Cross-Site Request Forgery
Open WebUI >0.7.0 <0.11.4 contains a cross-origin message handling vulnerability caused by unvalidated verify:chat messages in SyncStatsModal, letting remote attackers steal session tokens, exploit requires crafted cross-origin messages.
- 7.1 /10 HighCVE-2026-109242 No auth
FreeRDP - Information Disclosure & Denial of Service
FreeRDP < 3.0.0 and 3.6.0 < 3.32.0 contain an information disclosure and denial of service caused by uninitialized heap memory rendering in progressive tiles, letting malicious RDP servers leak memory or crash clients, exploit requires malicious server interaction.
- 8.6 /10 HighCVE-2026-109238 No auth
Crawl4AI - Server-Side Request Forgery
Crawl4AI < 0.9.4 contains a server-side request forgery caused by enabling link_preview_config on /crawl requests, letting API clients access internal addresses, exploit requires crafted API requests with specific parameters.
- 8.1 /10 HighCVE-2026-109237 Auth required
Crawl4AI - Authentication Bypass
Crawl4AI 0.9.0 before 0.9.4 contains an untrusted-config gate bypass caused by wrapping forbidden config objects in dict-type wrappers, letting non-admin API clients read secret keys and forge admin JWTs, exploit requires non-admin API access.
- 7.5 /10 HighCVE-2026-109229 No auth
SGLang - Denial of Service
SGLang through 0.5.21 contains a denial of service vulnerability caused by disabling Pillow decompression bomb protection in NanoNemotronVLImageProcessor, letting remote attackers exhaust memory by submitting highly compressed large images, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-109228 No auth
SGLang - Denial of Service
SGLang through 0.5.21 contains a denial of service caused by resource budget bypass via manipulation of fps, max_frames, max_tokens_per_frame, and max_image_tokens in video_url, letting remote attackers exhaust worker memory, exploit requires crafted video_url parameters.