High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 141 of 556
- 8.7 /10 HighCVE-2026-105409 Auth required
Tuleap Enterprise Edition - Stored XSS
Tuleap Enterprise Edition 17.0 through 17.5 contains a stored XSS caused by improper sanitization of user input, letting attackers execute arbitrary script code in users' browser sessions, exploit requires user interaction.
- 8.7 /10 HighCVE-2026-105408 Auth required
Tuleap Enterprise Edition - Stored XSS
Tuleap Enterprise Edition 17.0 through 17.5 contains a stored XSS caused by improper sanitization of user input, letting attackers execute arbitrary script code in users' browser sessions, exploit requires user interaction.
- 8.8 /10 HighCVE-2026-105407 Auth required
Tuleap Enterprise Edition - Command Injection
Tuleap Enterprise Edition >= 17.0 and <= 17.5 contains an OS command injection caused by improper input sanitization, letting attackers execute arbitrary commands on the server, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-105052 No auth
IBM Maximo Application Suite - Path Traversal
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 contain a path traversal vulnerability caused by improper sanitization of URL requests with "dot dot" sequences (/../), letting remote attackers view arbitrary files, exploit requires crafted URL request.
- 7.0 /10 HighCVE-2026-104355
Temporal Server - Broken Access Control
Temporal Server in multi-cluster deployments contains a broken access control vulnerability caused by improper validation of inbound namespace replication updates, letting a connected peer cluster modify local namespaces without credentials, exploit requires control over a registered peer cluster.
- 8.8 /10 HighCVE-2026-103903 Auth required
MikroTik RouterOS - Authentication Bypass
MikroTik RouterOS contains an incorrect authorization vulnerability in the WinBox authentication flow, letting remote authenticated low-privilege users escalate to full administrative privileges by specifying a higher-privilege account, exploit requires valid low-privilege credentials.
- 7.5 /10 HighCVE-2026-103902 No auth
DigiDoc - Authentication Bypass
DigiDoc libdigidocpp 4.0.0 < 4.5.0, DigiDoc4 4.6.0 < 4.11.0, DigiDoc Android 2.7.0 < 3.1.0, and DigiDoc iOS 2.7.0 < 3.1.0 contain an improper verification of cryptographic signature vulnerability caused by flawed signature validation, letting attackers create forged digital signatures, exploit requires crafted signature input.
- 7.2 /10 HighCVE-2026-103522 Auth required
Thelia - Remote Code Execution
Thelia 2.6.0 contains a remote code execution caused by insufficient filetype validation relying on client-supplied MIME types in the store banner upload feature, letting attackers with admin access execute arbitrary code remotely.
- 7.2 /10 HighCVE-2026-103521 Auth required
Thelia - Remote Code Execution
Thelia v2.6.0 contains a remote code execution caused by lack of executable file type validation in the document update endpoint, letting attackers with admin permissions upload malicious executables, exploit requires admin privileges.
- 7.5 /10 HighCVE-2026-103060 No auth
Erlang rebar3 - Path Traversal
Erlang rebar3 >= 3.7.0-rc1 and < 3.27.2 contains a path traversal caused by improper validation of the app field in package dependencies, letting malicious package publishers delete directories outside the _build directory and write files, exploit requires fetching malicious dependencies.
- 8.8 /10 HighCVE-2026-102627 Auth required
IBM TRIRIGA Application Platform - Remote Code Execution
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 contains a remote code execution caused by improper validation of file paths during archive extraction, letting remote authenticated attackers execute arbitrary code.
- 8.1 /10 HighCVE-2025-71432 No auth
Frappe ERPNext - Reflected XSS
Frappe ERPNext < 14.92.1 and 15.x < 15.83.0 contain a reflected cross-site scripting vulnerability caused by missing input validation on a certain page, letting remote attackers execute arbitrary JavaScript in authenticated sessions, exploit requires victim to be logged in and open crafted URL.
- 8.8 /10 HighCVE-2024-58390 Auth required
Frappe - Broken Access Control
Frappe < 14.81.4 and 15.x < 15.41.0 contains a broken access control vulnerability caused by improper privilege management in a document action, letting authenticated Website User role attackers escalate to System Manager privileges.
- 8.2 /10 HighCVE-2021-48012 No auth
fast-toml - Prototype Pollution
fast-toml <= 0.5.4 contains a prototype pollution vulnerability caused by parsing TOML with __proto__, constructor, or prototype keys, letting attackers cause denial of service or authorization bypass, exploit requires crafted TOML input.
- 7.5 /10 HighCVE-2021-48011 No auth
Servor - Path Traversal
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability caused by improper decoding of URL-encoded dot segments in serveStaticFile and serveDirectoryListing, letting unauthenticated remote attackers read arbitrary files and list directories outside the root, exploit requires no authentication.