High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 165 of 556
- 8.5 /10 HighCVE-2026-93699 Auth required
WP Toolkit for cPanel - Command Injection
WP Toolkit for cPanel contains a command injection caused by improper argument handling, letting local users execute arbitrary code as other accounts on the same server, exploit requires local access.
- 7.7 /10 HighCVE-2026-93017 Auth required
OpenShift insights-operator-gather - Broken Access Control
OpenShift insights-operator-gather ClusterRole grants the operator's service account unrestricted read access to all secrets across all namespaces, letting attackers with gather service account access read any secret, exploit requires attacker to spawn a pod with the gather service account.
- 7.3 /10 HighCVE-2026-91844 Auth required
İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip - Unrestricted File Upload
İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip v1.6.4 to before v1.6.6 contains an unrestricted file upload vulnerability caused by lack of file type restrictions, letting attackers upload malicious files remotely, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-89091 No auth
ansible-core - Path Traversal & Remote Code Execution
ansible-core contains a path traversal caused by improper symlink resolution in ansible-galaxy collection install archive extraction, letting attackers overwrite arbitrary files and execute code on the control node, exploit requires victim to install a malicious collection.
- 7.3 /10 HighCVE-2026-87687 Auth required
Brocade Fabric OS - Broken Access Control
Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an authorization and input validation vulnerability caused by improper validation of fabric identifiers, letting authenticated restricted users perform unauthorized cross-fabric operations and view configuration details, exploit requires authenticated user with restricted privileges.
- 8.8 /10 HighCVE-2026-87683 Auth required
Brocade Fabric OS - Buffer Overflow
Brocade Fabric OS < 10.0.1 contains stack-based buffer overflow vulnerabilities caused by improper validation of array counts and string lengths in REST API management component, letting authenticated attackers cause denial-of-service or execute arbitrary code, exploit requires REST API access.
- 8.8 /10 HighCVE-2026-87682 Auth required
Brocade Fabric OS - Command Injection
Brocade Fabric OS < 10.0.1 contains command injection vulnerabilities caused by improper input processing in management interface and session routines, letting authenticated users or compromised directory accounts execute OS commands with elevated privileges.
- 8.8 /10 HighCVE-2026-87680 Auth required
Brocade Fabric OS - Command Injection
Brocade Fabric OS < 10.0.1 contains a command injection caused by improper input validation in the REST API management interface, letting authenticated users execute arbitrary system commands.
- 7.2 /10 HighCVE-2026-87679 Auth required
Brocade Fabric OS - Buffer Overflow
Brocade Fabric OS < 10.0.1 contains a buffer overflow caused by lack of boundary checks on user-supplied list strings in trunk configuration operations, letting authenticated administrators cause heap corruption leading to service crash or code execution.
- 7.8 /10 HighCVE-2026-87674 Auth required
Brocade Fabric OS - Privilege Escalation
Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contains a local privilege escalation caused by insufficient access controls and improper input sanitization in the system logging daemon's IPC channels, letting unprivileged local users execute arbitrary directives with elevated privileges, exploit requires local access.
- 7.2 /10 HighCVE-2026-87673 Auth required
Brocade Fabric OS - Command Injection
Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an OS command injection caused by unsanitized input in maintenance command-line diagnostic utilities, letting privileged maintenance users execute arbitrary OS commands as root.
- 7.5 /10 HighCVE-2026-87671 No auth
Brocade Fabric OS - Denial of Service
Brocade Fabric OS < 10.0.1 contains an out-of-bounds read caused by improper validation of URL query parameters in the web management daemon, letting unauthenticated remote attackers cause denial of service via crafted HTTP requests.
- 8.0 /10 HighCVE-2026-87666 Auth required
Brocade Fabric OS - OS Command Injection
Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an OS command injection caused by improper input sanitization in timezone management subsystem, letting authenticated low-privilege admin users execute arbitrary shell commands with elevated privileges.
- 7.5 /10 HighCVE-2026-87665 No auth
Brocade Fabric OS - Denial of Service
Brocade Fabric OS < 10.0.1 contains a stack-based buffer overflow caused by processing oversized Nonce payloads in IKEv2 protocol handler on IPsec-enabled FCIP circuits, letting unauthenticated remote attackers cause denial of service via crafted UDP packets on port 500.
- 7.8 /10 HighCVE-2026-87664 Auth required
Brocade Fabric OS - Broken Access Control
Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 contain a broken access control vulnerability caused by improper verification of IPC storage callbacks in the web management daemon, letting attackers gain administrative privileges without authentication.