High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 162 of 556
- 8.4 /10 HighCVE-2026-107818 Auth required
MariaDB Server - Privilege Escalation
MariaDB server 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 contains a privilege escalation caused by attacker-controlled environment injection via /run/mysqld/wsrep-new-cluster file, letting database users with FILE privilege escalate privileges, exploit requires FILE privilege and writable secure-file-priv directory.
- 8.5 /10 HighCVE-2026-107815 Auth required
MariaDB Server - Buffer Overflow
MariaDB server 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 contains a buffer overflow caused by incorrect boundary check in CONNECT engine's DOS table type, letting authenticated users cause crash or remote code execution, exploit requires authentication and CONNECT engine usage.
- 8.4 /10 HighCVE-2026-107814 Auth required
MariaDB - Privilege Escalation
MariaDB server 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 RPM packages contain a privilege escalation caused by FILE privilege users writing startup dot-files in mysql service account home directory, letting database users escalate privileges when admin opens mysql login shell, exploit requires FILE privilege.
- 8.8 /10 HighCVE-2026-107813 Auth required
Nginx UI - Authentication Bypass
Nginx UI 2.0.0 to 2.5.0 contains a broken authentication caused by missing RequireSecureSession enforcement on api/cluster router, letting authenticated OTP-enabled users with stolen JWT perform node and cluster operations without second-factor, exploit requires valid JWT token.
- 7.5 /10 HighCVE-2026-107812 No auth
Nginx UI - Remote Code Execution
Nginx UI 2.0.0 to 2.5.0 contains a remote code execution caused by insufficient validation of downloaded binaries in the self-upgrade mechanism, letting attackers supply malicious executables, exploit requires operator-triggered upgrade.
- 8.8 /10 HighCVE-2026-107811 Auth required
Nginx UI - Broken Access Control
Nginx UI 2.0.0 to 2.5.0 contains a broken access control caused by serialization of node token in /api/nodes endpoints, letting authenticated users impersonate trusted nodes and perform sensitive management operations, exploit requires user authentication.
- 8.1 /10 HighCVE-2026-107810 Auth required
Nginx UI - Path Traversal
Nginx UI 2.0.0 to 2.5.0 contains a file system write vulnerability caused by symlink extraction in backup restore process, letting authenticated users inject configuration or cause denial of service, exploit requires backup creation and restore privileges.
- 8.8 /10 HighCVE-2026-107809 No auth
Nginx UI - Cross-Site Request Forgery
Nginx UI 2.0.0 to 2.5.0 contains a cross-site request forgery caused by missing CSRF token and Origin/Referer validation in management endpoints, letting remote attackers induce authenticated admin actions, exploit requires admin login without OTP/Passkey.
- 8.1 /10 HighCVE-2026-107808 No auth
Nginx UI - Authentication Bypass
Nginx UI 2.0.0 to 2.5.0 contains an authentication bypass caused by missing WebAuthn assertion check when EnabledPasskey is true and no TOTP secret is configured, letting attackers with password access bypass 2FA and reach admin functions.
- 8.8 /10 HighCVE-2026-107807
Nginx UI - Authentication Bypass
Nginx UI 2.0.0 to 2.5.0 contains an authentication bypass caused by accepting Node.Secret via node_secret query parameter instead of header, letting attackers with the secret gain persistent admin API access, exploit requires obtaining the secret.
- 7.5 /10 HighCVE-2026-107805 No auth
Nginx UI - Denial of Service
Nginx UI 2.5.0 to < 2.6.0 contains a denial of service caused by temporary file staging of attacker-controlled request body in node-signature authentication path, letting unauthenticated remote clients exhaust filesystem and processing resources, exploit requires API access with valid signature metadata.
- 7.3 /10 HighCVE-2026-106581 Auth required
Docker Desktop for Windows - Privilege Escalation
Docker Desktop for Windows < 4.92.0 contains a privilege escalation vulnerability caused by lack of signature verification in Docker Desktop Installer.exe install -package, letting attackers execute installer actions as LocalSystem, exploit requires user approval of UAC prompt.
- 8.9 /10 HighCVE-2026-106155 Auth required
In Progress Telerik Report Server - Stored XSS & Privilege Escalation
In Progress Telerik Report Server < 12.2.26.1007 contains a stored XSS caused by embedding javascript: or vbscript: URLs in report navigation or HTML text box links, letting authenticated report authors execute scripts in other users' sessions, exploit requires authenticated report author.
- 7.1 /10 HighCVE-2026-106145 Auth required
In Progress Telerik Report Server - Broken Access Control
In Progress Telerik Report Server < 12.2.26.1007 contains a broken access control caused by incorrect privilege assignment in the service-agent SignalR hub, letting authenticated low-privilege users escalate privileges to access protected secrets and impersonate agents, exploit requires valid bearer token.
- 7.1 /10 HighCVE-2026-105883 Auth required
ThemeHunk Th Shop Mania - Broken Access Control
ThemeHunk Th Shop Mania <= 1.9.1 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.