High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 160 of 556
- 7.1 /10 HighCVE-2026-29797 Auth required
N-Tron - Authentication Bypass
N-Tron devices contain an authentication bypass caused by lack of authentication in firmware and bootloader update processes via SNMP/TFTP, letting attackers push or pull firmware remotely without authentication.
- 7.5 /10 HighCVE-2026-28745
Generic Product - Weak Cryptography
A product contains a weak cryptography vulnerability caused by storing usernames and passwords, including default credentials, with weak encryption in the configuration file, letting attackers obtain other credentials if default credentials are known, exploit requires knowledge of default credentials.
- 8.2 /10 HighCVE-2026-22061 Auth required
Trident - Information Disclosure
Trident v25.02.1 through v26.06.1 contains an information disclosure vulnerability caused by improper protection of debug logs, letting authenticated attackers view LUKS passphrases or SMB Active Directory credentials, exploit requires authentication and access to debug logs.
- 7.8 /10 HighCVE-2026-19575 Auth required
Zephyr OS - Privilege Escalation
Zephyr OS v4.2.x and v4.3.x with CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT enabled contains a privilege escalation vulnerability caused by improper validation of the dev argument in device_deinit() syscall, letting local unprivileged threads execute arbitrary kernel code, exploit requires CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT enabled.
- 7.0 /10 HighCVE-2026-19574 Auth required
Linux ARM64 - Broken Access Control
The ARM64 Linux kernel contains a broken access control vulnerability in arch_mem_domain_init() due to ASID reuse after wraparound, letting user-mode threads bypass memory domain isolation and access other domains' memory, exploit requires creating more than 255 memory domains.
- 8.8 /10 HighCVE-2026-19570 No auth
Zephyr Bluetooth LE Audio Broadcast Sink - Buffer Overflow
Zephyr Bluetooth LE Audio Broadcast Sink contains a buffer overflow caused by lack of bounds checking when copying subgroup metadata from Basic Audio Announcement (BASE), letting remote attackers in radio range cause memory corruption and potential remote code execution, exploit requires attacker to be in radio range and send crafted BASE data.
- 8.8 /10 HighCVE-2026-19569
Zephyr Kernel - Buffer Overflow
Zephyr kernel with CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS contains a buffer overflow caused by unchecked unsigned integer wrap-around in dynamic_object_create() size calculations, letting unprivileged user-mode threads perform out-of-bounds writes to kernel heap, exploit requires CONFIG_USERSPACE, CONFIG_DYNAMIC_OBJECTS, and a thread with assigned resource pool.
- 7.6 /10 HighCVE-2026-108260 Auth required
TinaCMS tina-markdown - Stored XSS
TinaCMS tina-markdown element < 0.2.1 contains a stored XSS caused by unvalidated URL scheme in rich-text node.url assigned to anchor href, letting content authors execute scripts in site origin, exploit requires content author privileges.
- 8.2 /10 HighCVE-2026-108259
Tina @tinacms/cli - Template Injection
Tina @tinacms/cli < 3.0.0 contains a template injection caused by unsafe interpolation of Git branch names into JavaScript string literals, letting attackers execute arbitrary code during preview builds, exploit requires crafted Git branch name.
- 7.5 /10 HighCVE-2026-108160 No auth
AstronRPA - Remote Code Execution
AstronRPA through 1.1.6 contains a code download without integrity check vulnerability caused by lack of signature verification in the auto-update mechanism, letting network attackers execute code as the desktop user by serving malicious updates.
- 7.5 /10 HighCVE-2026-108159 No auth
AstronRPA - Stored XSS & Remote Code Execution
AstronRPA through 1.1.6 contains a stored XSS caused by unsanitized LLM output rendered via v-html in the desktop client's smart-component chat, letting remote attackers execute OS commands, exploit requires crafted web page embedding prompt-injection content.
- 8.1 /10 HighCVE-2026-108157 No auth
Pingvin Share X - Authentication Bypass
Pingvin Share X > 0.19.0 and < 1.22.0 contains an authentication bypass caused by missing email_verified check in GenericOidcProvider during OAuth email linking, letting remote unauthenticated attackers take over accounts including administrators, exploit requires enabled OAuth/OIDC provider and unverified victim email.
- 7.1 /10 HighCVE-2026-108156 No auth
LobsterAI - Path Traversal
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability caused by trusting openclawSourceDir from a skill's _meta.json in the skills:delete IPC handler, letting attackers cause recursive deletion of arbitrary user-writable directories during skill uninstallation, exploit requires user to install a crafted skill.
- 7.1 /10 HighCVE-2026-108125 Auth required
wp-post-author - SQL Injection
wp-post-author < 4.1.0 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-108113 Auth required
ILIAS - Unrestricted File Upload
ILIAS < 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity), letting authenticated authors achieve remote code execution by uploading crafted archives with executable files.