High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 137 of 552
- 7.2 /10 HighCVE-2026-108361 Auth required
Privasys Remote Attestation TLS Clients - Authentication Bypass
Privasys Remote Attestation TLS Clients < 0.9.1 contains a broken authentication caused by attestation performed only once at connection establishment, letting local attackers modify workload state during connection lifetime, exploit requires local access.
- 7.8 /10 HighCVE-2026-108094 Auth required
Mutter - Use After Free
Mutter contains a use-after-free vulnerability caused by asynchronous ICC file read handling in the Wayland color-management ICC image-description path, letting local attackers executing malicious Wayland clients cause crashes or arbitrary code execution.
- 7.1 /10 HighCVE-2026-105668 Auth required
Hexpm hex - Protection Mechanism Failure
Hexpm hex 2.5.0 to < 2.5.2 contains a protection mechanism failure caused by improper cooldown bypass logic in package release handling, letting package owners or attackers who compromise owners bypass release-age cooldown, exploit requires package ownership or account compromise.
- 8.8 /10 HighCVE-2026-105465
IBM Db2 - Privilege Escalation
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contains a privilege escalation vulnerability caused by db2locssh being enabled with the db2 instance, letting attackers escalate privileges, exploit requires db2locssh enabled.
- 8.8 /10 HighCVE-2026-105464 Auth required
IBM Db2 - Privilege Escalation
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows contains a privilege escalation caused by improper privilege management, letting local attackers gain elevated privileges, exploit requires local access.
- 7.1 /10 HighCVE-2026-105412 Auth required
Tuleap Enterprise Edition - SQL Injection
Tuleap Enterprise Edition 17.5 contains an SQL injection caused by unsanitized input, letting attackers read the Tuleap database, exploit requires crafted input.
- 8.1 /10 HighCVE-2026-105411 Auth required
Tuleap Enterprise Edition - Authorization Bypass
Tuleap Enterprise Edition 17.0 through 17.5 contains an authorization bypass through user-controlled key caused by improper access control in tracker administration, letting attackers with tracker admin rights update or delete fields across all trackers, exploit requires tracker administration privileges.
- 8.7 /10 HighCVE-2026-105410 Auth required
Tuleap Enterprise Edition - Stored XSS
Tuleap Enterprise Edition 17.0 through 17.5 contains a stored XSS caused by improper sanitization of user input, letting attackers execute arbitrary script code in users' browser sessions, exploit requires user interaction.
- 8.7 /10 HighCVE-2026-105409 Auth required
Tuleap Enterprise Edition - Stored XSS
Tuleap Enterprise Edition 17.0 through 17.5 contains a stored XSS caused by improper sanitization of user input, letting attackers execute arbitrary script code in users' browser sessions, exploit requires user interaction.
- 8.7 /10 HighCVE-2026-105408 Auth required
Tuleap Enterprise Edition - Stored XSS
Tuleap Enterprise Edition 17.0 through 17.5 contains a stored XSS caused by improper sanitization of user input, letting attackers execute arbitrary script code in users' browser sessions, exploit requires user interaction.
- 8.8 /10 HighCVE-2026-105407 Auth required
Tuleap Enterprise Edition - Command Injection
Tuleap Enterprise Edition >= 17.0 and <= 17.5 contains an OS command injection caused by improper input sanitization, letting attackers execute arbitrary commands on the server, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-105052 No auth
IBM Maximo Application Suite - Path Traversal
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 contain a path traversal vulnerability caused by improper sanitization of URL requests with "dot dot" sequences (/../), letting remote attackers view arbitrary files, exploit requires crafted URL request.
- 7.0 /10 HighCVE-2026-104355
Temporal Server - Broken Access Control
Temporal Server in multi-cluster deployments contains a broken access control vulnerability caused by improper validation of inbound namespace replication updates, letting a connected peer cluster modify local namespaces without credentials, exploit requires control over a registered peer cluster.
- 8.8 /10 HighCVE-2026-103903 Auth required
MikroTik RouterOS - Authentication Bypass
MikroTik RouterOS contains an incorrect authorization vulnerability in the WinBox authentication flow, letting remote authenticated low-privilege users escalate to full administrative privileges by specifying a higher-privilege account, exploit requires valid low-privilege credentials.
- 7.5 /10 HighCVE-2026-103902 No auth
DigiDoc - Authentication Bypass
DigiDoc libdigidocpp 4.0.0 < 4.5.0, DigiDoc4 4.6.0 < 4.11.0, DigiDoc Android 2.7.0 < 3.1.0, and DigiDoc iOS 2.7.0 < 3.1.0 contain an improper verification of cryptographic signature vulnerability caused by flawed signature validation, letting attackers create forged digital signatures, exploit requires crafted signature input.