High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 168 of 556
- 7.5 /10 HighCVE-2026-82627 Auth required
Uncanny Automator WordPress - PHP Object Injection
Uncanny Automator WordPress plugin <= 7.6.1.1 contains a PHP Object Injection caused by deserialization of untrusted input in trigger meta, letting authenticated attackers with Subscriber-level access delete arbitrary files, exploit requires third-party integration and configured recipe.
- 8.1 /10 HighCVE-2026-82344 No auth
IBM Guardium Data Protection - Buffer Overflow
IBM Guardium Data Protection 12.0, 12.1 contains a heap-based buffer overflow caused by improper handling of TDS login fragments in S-TAP TrafficTap login reassembly, letting unauthenticated remote attackers cause denial of service or execute arbitrary code.
- 8.1 /10 HighCVE-2026-82335 No auth
IBM Guardium Data Protection - Buffer Overflow
IBM Guardium Data Protection 12.0, 12.1, 12.2 contains a heap-based buffer overflow caused by a specially crafted MongoDB SCRAM username in the MongoDB protocol parser, letting remote attackers cause denial of service or execute arbitrary code, exploit requires crafted MongoDB SCRAM username.
- 8.1 /10 HighCVE-2026-82334 No auth
IBM Guardium Data Protection - Out of Bounds Read
IBM Guardium Data Protection 12.0, 12.1, 12.2 contains a heap-based out-of-bounds read caused by invalid offset or length values in the TDS7 LOGIN7 protocol parser, letting remote attackers cause information disclosure or denial of service, exploit requires crafted TDS LOGIN7 packets.
- 8.6 /10 HighCVE-2026-81932 No auth
IBM Guardium Data Protection - SQL Injection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a SQL injection caused by improper sanitization of SQL statements, letting remote unauthenticated attackers view, add, modify, or delete database information, exploit requires crafted SQL input.
- 7.5 /10 HighCVE-2026-78669
HTTP/2 - Denial of Service
HTTP/2 protocol contains a denial of service vulnerability caused by excessive CPU consumption from many small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values, letting malicious peers cause resource exhaustion, exploit requires a malicious HTTP/2 peer.
- 7.5 /10 HighCVE-2026-78667 No auth
Go HTTP Server - Denial of Service
FileServer, ServeContent, and ServeFile in Go HTTP server contain a denial of service caused by excessive CPU consumption when parsing Range headers with many small ranges, letting remote attackers cause resource exhaustion, exploit requires crafted Range header.
- 7.5 /10 HighCVE-2026-78660 No auth
HTTP/2 Reverse Proxy - HTTP Request Smuggling
An HTTP/2 implementation in a reverse proxy forwards malformed framing-related headers to HTTP/1 clients, causing HTTP request smuggling when the HTTP/1 client is not strict, letting attackers smuggle requests.
- 7.5 /10 HighCVE-2026-78659 No auth
Go HTTP Server - Denial of Service
Go HTTP server contains a denial of service vulnerability caused by excessive 'Trailer' headers in HTTP/2 requests, letting remote attackers exhaust server memory, exploit requires HTTP/2 protocol support.
- 7.1 /10 HighCVE-2026-71895 Auth required
Apache DolphinScheduler - Authorization Bypass
Apache DolphinScheduler 3.2.0 to before 3.4.3 contains an authorization vulnerability caused by improper access control to Kubernetes configuration data, letting authenticated non-admin users retrieve sensitive kubeconfig credentials, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-71183 Auth required
Apache DolphinScheduler - Broken Access Control
Apache DolphinScheduler < 3.4.3 contains an authorization vulnerability caused by missing access control enforcement in /unauth-datasource and /authed-datasource endpoints, letting authenticated users access unauthorized sensitive data source information, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-67693
GnuTLS - Information Disclosure
GnuTLS 3.8.13 contains an information disclosure vulnerability caused by failure to reject end-entity X.509 certificates with contradictory Key Usage and Extended Key Usage, letting attackers obtain sensitive information, exploit requires crafted certificates.
- 7.1 /10 HighCVE-2026-66479 No auth
Liquid Web / StellarWP WPComplete - Stored XSS
Liquid Web / StellarWP WPComplete <= 2.9.5.6 contains a stored XSS caused by insufficient input sanitization, letting attackers execute scripts via stored payloads, exploit requires victim interaction.
- 8.1 /10 HighCVE-2026-66087 Auth required
Apache DolphinScheduler - Authorization Bypass
Apache DolphinScheduler before 3.4.3 contains an authorization bypass caused by insufficient access control in task instance operations, letting authenticated users operate task instances in unauthorized projects, exploit requires user authentication.
- 8.1 /10 HighCVE-2026-66084 Auth required
Apache DolphinScheduler - Authorization Bypass
Apache DolphinScheduler < 3.4.3 contains an authorization bypass caused by improper verification of task definition ownership in the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint, letting authenticated users modify task definitions in unauthorized projects, exploit requires user authentication.