High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 145 of 556
- 7.6 /10 HighCVE-2026-108760 No auth
LlamaFarm - Broken Access Control
LlamaFarm through 0.0.34 contains a broken access control caused by insecure default FastAPI server binding and ignored HOST overrides, letting network-adjacent attackers read API keys, modify and delete projects, exploit requires network access.
- 8.2 /10 HighCVE-2026-108758 No auth
Easy!Appointments - Authorization Bypass
Easy!Appointments through 1.6.0 contains an authorization bypass caused by lack of hash verification in Booking::register(), letting unauthenticated attackers modify appointments by supplying appointment IDs without hashes, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-108746 Auth required
Vearch - Broken Access Control
Vearch 3.5.2 through 3.5.9 contains a broken access control vulnerability caused by incorrect authorization in Role.HasPermissionForResources, letting authenticated non-root users escalate privileges to cluster administrator by upserting, deleting documents, or modifying roles.
- 7.0 /10 HighCVE-2026-108744 No auth
pbi-cli - Command Injection
pbi-cli 3.10.1 through 3.12.0 contains a command injection caused by unquoted .pbip paths passed to cmd /c start in desktop_sync.py, letting attackers execute OS commands with victim privileges when reopening projects, exploit requires victim to open crafted project path.
- 8.3 /10 HighCVE-2026-108740 Auth required
GoatCounter - Privilege Escalation
GoatCounter <= 2.7.0 contains a privilege escalation caused by mass assignment in the userPrefSave handler, letting logged-in users modify protected account fields to gain superuser or admin access, exploit requires user to be logged in.
- 7.5 /10 HighCVE-2026-108739 No auth
OpenAgents Workspace - Information Disclosure
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability caused by unauthenticated access to GET /v1/workspaces, letting attackers read sensitive workspace details including unmasked API keys, ids, emails, and member lists.
- 8.1 /10 HighCVE-2026-108718 No auth
Rill - Broken Access Control
Rill 0.77.0 through 0.90.5 contains a broken access control vulnerability caused by missing authorization in the admin OAuth server, letting attackers obtain non-expiring API tokens with full user permissions, exploit requires user interaction.
- 7.5 /10 HighCVE-2026-108714 No auth
MCP Kotlin SDK - Denial of Service
MCP Kotlin SDK <= 0.15.0 contains a denial of service vulnerability caused by lack of maxFrameSize limit in Ktor WebSockets in Application.mcpWebSocket, letting remote clients exhaust server memory by sending large payloads, exploit requires network access.
- 8.8 /10 HighCVE-2026-108708 Auth required
Wukong_HRM - Broken Access Control
Wukong_HRM contains a broken access control vulnerability caused by EmployeeAspect assigning HR administrator role to every caller and EmployeeUtil data-scope checks returning all employees, letting authenticated low-privileged employees read and modify sensitive company-wide data, exploit requires authentication.
- 7.1 /10 HighCVE-2026-108695 Auth required
MultiVendorX WordPress Plugin - Broken Access Control
MultiVendorX WordPress plugin through 5.0.19 contains a broken access control vulnerability caused by insufficient authorization checks in the settings REST endpoint, letting attackers with store_owner role modify marketplace-wide settings via POST requests.
- 7.0 /10 HighCVE-2026-108693
ImageMagick - Command Injection
ImageMagick on Windows <= 7.1.2-33 and <= 6.9.13-58 contains a command injection caused by uncontrolled search path in NTGhostscriptEXE() launching gswin64c.exe by bare name when Ghostscript is unregistered, letting attackers execute code with ImageMagick privileges, exploit requires attacker to place malicious executable in working directory.
- 7.3 /10 HighCVE-2026-108571 No auth
Xinhu Rainrock RockOA - SQL Injection
Xinhu Rainrock RockOA <= 2.7.6 contains a sql injection caused by manipulation of the "ID" argument in kqjcmdModel::returnchuli function of Openkqj Action, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 8.3 /10 HighCVE-2026-108522 No auth
Studio-Saelix Sencho - Authentication Bypass
Studio-Saelix Sencho <= 0.94.1 contains an authentication bypass caused by manipulation of the X-Forwarded-For header in the Login Endpoint /api/auth/login, letting remote attackers bypass authentication, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-106029 No auth
WeddingCity Lite WordPress - Broken Access Control
WeddingCity Lite WordPress plugin through 1.0.4 contains a broken access control vulnerability caused by lack of authorization checks before deleting posts, pages, and media, letting unauthenticated attackers delete arbitrary content site-wide.
- 7.2 /10 HighCVE-2026-104680 Auth required
Envira Gallery WordPress plugin - Broken Access Control
Envira Gallery WordPress plugin < 1.16.2 contains a broken access control vulnerability caused by improper capability verification during setup-wizard installation requests, letting Multisite subsite Administrators install arbitrary plugins reserved for Super Admins.