High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 16 of 552
- 8.1 /10 HighCVE-2026-92154 Auth required
F´ (F Prime) - Data Tampering & Denial of Service
F´ (F Prime) < 4.2.0 contains a file integrity loss vulnerability caused by improper offset and size validation in Svc::FileUplink handleDataPacket, letting attackers write beyond declared upload size, exploit requires crafted file-uplink DATA packet.
- 7.1 /10 HighCVE-2026-92153 Auth required
F´ (F Prime) - Path Traversal
F´ (F Prime) < 4.3.0 contains a path traversal caused by lack of canonicalization in Svc::FileUplink destination path handling, letting attackers create or overwrite files at arbitrary writable locations, exploit requires ability to send file-uplink packets.
- 7.5 /10 HighCVE-2026-92151 No auth
F´ (F Prime) - Denial of Service
F´ (F Prime) < 4.2.0 contains a denial of service caused by improper handling of minimum packet-length in Svc::Ccsds::SpacePacketDeframer dataIn_handler, letting attackers cause process abort or reset, exploit requires sending short CCSDS telecommand frames.
- 7.5 /10 HighCVE-2026-92150 No auth
F´ (F Prime) - Denial of Service
F´ (F Prime) < 4.2.0 contains a denial of service caused by improper deserialization validation in Svc::GenericHub fromBufferDriver_handler, letting unauthenticated inter-processor peers abort or reset the process, exploit requires unauthenticated inter-processor hub peer to send malformed buffers.
- 8.6 /10 HighCVE-2026-91882 No auth
Dell Terraform Provider for OME - Information Disclosure
Dell Terraform Provider for OME 1.0.0 through 1.2.3 contains an insertion of sensitive information into externally-accessible file or directory caused by improper error handling in the API client, letting unauthenticated remote attackers expose sensitive information, exploit requires remote access.
- 8.8 /10 HighCVE-2026-91184 Auth required
NGINX Gateway Fabric - Command Injection
NGINX Gateway Fabric contains a command injection caused by unescaped rendering of spec.basic.realm and spec.jwt.realm fields in AuthenticationFilter CRD, letting authenticated attackers inject arbitrary NGINX directives, exploit requires authenticated access to configure AuthenticationFilter.
- 7.7 /10 HighCVE-2026-91159 PoC publicAuth required
Discourse - Stored XSS
Discourse < 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 contains a stored XSS caused by trusted processing of attacker-controlled HTML fragments with allowlisted iframes in oEmbed, letting users with posting permission inject misleading UI, exploit requires posting account and control of allowlisted iframe source.
- 7.5 /10 HighCVE-2026-91157 No auth
Discourse - Broken Access Control
Discourse < 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 contains an information disclosure vulnerability caused by improper reconciliation of upload security metadata when category permissions change, letting anonymous users access restricted media via short URLs, exploit requires secure uploads enabled and category permission changes.
- 7.5 /10 HighCVE-2026-91156 No auth
Discourse - Broken Access Control
Discourse < 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 contains an information disclosure caused by improper enforcement of Chat eligibility in MessageBus audience calculation, letting authenticated users access restricted live and recent chat messages, exploit requires user to be authenticated and have category view permissions.
- 7.8 /10 HighCVE-2026-90954 No auth
BusyBox - Path Traversal
BusyBox contains a path traversal caused by improper symlink flushing order in dpkg-deb archive extraction, letting attackers write arbitrary files outside the extraction directory, exploit requires crafted .deb archive.
- 8.6 /10 HighCVE-2026-89288 No auth
Fast Courier WordPress plugin - SQL Injection
Fast Courier WordPress plugin < 5.2.4 contains a SQL injection caused by unsanitized and unescaped input in an unauthenticated REST route, letting unauthenticated attackers read arbitrary database data.
- 7.5 /10 HighCVE-2026-89077 Auth required
Progress MOVEit Transfer - Authentication Bypass
Progress MOVEit Transfer (SFTP module) < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an authentication bypass caused by incorrect implementation of authentication algorithm, letting attackers bypass authentication, exploit requires no special conditions.
- 7.2 /10 HighCVE-2026-89076 Auth required
Progress MOVEit Transfer - SQL Injection
Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an SQL injection caused by improper neutralization of special elements in the Custom Reports module, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-89075 Auth required
Progress MOVEit Transfer - Insecure Storage of Sensitive Information
Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an insecure storage of sensitive information vulnerability caused by improper protection of sensitive data, letting attackers access sensitive information, exploit requires attacker access to stored data.
- 7.5 /10 HighCVE-2026-89074 Auth required
Progress MOVEit Transfer - Improper Input Handling
Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an improper unicode encoding handling vulnerability, letting attackers potentially cause unexpected behavior, exploit requires crafted input.