High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 169 of 556
- 8.8 /10 HighCVE-2026-62142 No auth
Melapress WP 2FA - Cross Site Request Forgery
Melapress WP 2FA wp-2fa <= 4.1.0 contains a cross site request forgery vulnerability caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.
- 7.5 /10 HighCVE-2026-56866 No auth
Go http.Transport - HTTP Request Smuggling
Go http.Transport contains a cross-user response poisoning vulnerability caused by improper handling of HTTP/1 CONNECT requests with non-empty bodies, letting attackers cause connection desynchronization and response injection, exploit requires use of shared Transport in reverse proxies.
- 8.0 /10 HighCVE-2026-5048 Auth required
Brocade SANnav - SQL Injection
Brocade SANnav < 3.0.0a contains an SQL injection caused by improper sanitization of REST API query parameters, letting authenticated attackers inject malicious data.
- 7.1 /10 HighCVE-2026-50054 Auth required
Zimbra Collaboration Suite - Authorization Bypass
Zimbra Collaboration Suite contains an authorization flaw in GrantRightsRequest, letting authenticated attackers grant loginAs rights to other local accounts, enabling persistent mailbox access and mail-sending authority.
- 7.5 /10 HighCVE-2026-44031 No auth
OFFIS DCMTK - Denial of Service
OFFIS DCMTK 3.7.0 contains a denial of service caused by uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() when parsing deeply nested DICOM sequences, letting remote unauthenticated attackers crash the process via crafted datasets.
- 7.1 /10 HighCVE-2026-40804 No auth
Kodezen LLC aBlocks - Reflected XSS
Kodezen LLC aBlocks <= 2.16.0 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted input.
- 8.1 /10 HighCVE-2026-19494 Auth required
IBM Security Verify Access & IBM Verify Identity Access - Authentication Bypass
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an authentication bypass caused by improper authentication, letting remote authenticated attackers bypass security restrictions.
- 7.5 /10 HighCVE-2026-19493 No auth
IBM Security Verify Access & IBM Verify Identity Access - Path Traversal
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a path traversal vulnerability caused by improper input validation, letting remote attackers perform arbitrary file write.
- 8.8 /10 HighCVE-2026-19482 Auth required
IBM Security Verify Access & IBM Verify Identity Access - Command Injection
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a command injection caused by improper neutralization of command arguments, letting remote authenticated attackers execute arbitrary commands.
- 8.8 /10 HighCVE-2026-19083 Auth required
AKIN Software OctoCloud - Authorization Bypass
AKIN Software OctoCloud >= 1.12.06 < 1.12.07 contains an authorization bypass caused by user-controlled key vulnerability, letting attackers access functionality not properly constrained by ACLs, exploit requires crafted requests.
- 8.8 /10 HighCVE-2026-18740 Auth required
IBM Security Verify Access & IBM Verify Identity Access - Broken Access Control
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an argument injection vulnerability in unspecified components, letting remote authenticated attackers perform unauthorized actions.
- 8.8 /10 HighCVE-2026-17196 Auth required
Super Forms – Drag & Drop Form Builder - Unrestricted File Upload
Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains an unrestricted file type upload caused by missing file type validation in upload_files function, letting authenticated attackers with Subscriber-level access upload executable files, exploit requires poisoning _super_elements post meta via super_save_form AJAX handler.
- 8.2 /10 HighCVE-2026-17189 No auth
IBM Security Verify Access & IBM Verify Identity Access - Stored XSS
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a stored XSS vulnerability caused by improper input sanitization in the Web UI, letting unauthenticated attackers embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session.
- 7.4 /10 HighCVE-2026-16181 No auth
IBM DataPower Gateway - Broken Access Control
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a broken access control vulnerability caused by improper authorization, letting remote attackers bypass security restrictions, exploit requires network access.
- 7.5 /10 HighCVE-2026-16179 No auth
IBM DataPower Gateway - Denial of Service
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a heap buffer underwrite vulnerability in the service component, letting attackers cause a service crash, exploit requires crafted input.