High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 17 of 725
- 8.8 /10 HighCVE-2026-73186 Auth required
Enable Media Replace - PHP Object Injection
Enable Media Replace <= 4.2.2 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-65566 No auth
Meow Apps AI Engine - Cross Site Request Forgery
Meow Apps AI Engine <= 3.8.8 contains a cross site request forgery caused by lack of CSRF protections, letting attackers force authenticated users to perform unintended actions, exploit requires victim interaction.
- 7.6 /10 HighCVE-2026-63414 Auth required
Shopify App - Broken Access Control
Shopify App 22.1.0 to 23.0.3 contains a broken access control caused by token-exchange authenticated controllers exposing request-derived shop context instead of verified Shopify ID token or session, letting attackers with a valid session token for one shop access or act on another shop's data, exploit requires token-exchange authentication and reliance on current_shopify_domain or params[:shop].
- 7.4 /10 HighCVE-2026-63398
Coop - Broken Access Control
Coop prior to 1.0.2 contains a broken access control vulnerability caused by SAML strategy's verify callback resolving users by email without organization binding, letting attackers with control of a SAML IdP signing key perform cross-tenant account takeover, exploit requires matching signing certificate in target organization.
- 8.7 /10 HighCVE-2026-63396 No auth
ROOST Coop - Information Disclosure
ROOST Coop < 1.0.0 contains an information disclosure caused by unauthenticated access to Query.allOrgs in /api/v1/graphql, letting unauthenticated actors obtain sensitive organization and user data, exploit requires public GraphQL API access.
- 8.7 /10 HighCVE-2026-63393 Auth required
OpenSearch SQL - Remote Code Execution
OpenSearch SQL 2.x >= 2.8.0.0 < 2.19.6.0 and 3.x < 3.7.0.0 contain an insecure deserialization vulnerability caused by unsafe deserialization of untrusted data in the plugins/sql endpoint, letting remote authenticated users with read/search permissions execute arbitrary code on the server, exploit requires authenticated user with read/search permissions.
- 8.8 /10 HighCVE-2026-63378 Auth required
TAKO AI Agent for Okta - Command Injection
TAKO AI Agent for Okta < 3.0.1-beta contains a command injection caused by insufficient validation of dynamic getattr calls in script_code field, letting authenticated users execute arbitrary Python code as root, exploit requires valid fctr_session cookie.
- 8.6 /10 HighCVE-2026-63346
Refitter - Remote Code Execution
Refitter < 2.1.2 contains a code injection vulnerability caused by unescaped quotation marks in header parameter names, letting attackers execute arbitrary code at assembly load via crafted OpenAPI descriptions, exploit requires attacker-controlled OpenAPI input.
- 8.6 /10 HighCVE-2026-63345
Refitter - Code Injection
Refitter < 2.1.2 contains a code injection caused by unescaped OpenAPI path keys in Refit route attributes, letting attackers execute code via a crafted path in generated assemblies, exploit requires compilation and loading of generated code.
- 8.6 /10 HighCVE-2026-63344
Refitter - Code Injection
Refitter < 2.1.2 contains a code injection caused by unescaped content-type keys in OpenAPI descriptions, letting attackers execute arbitrary code via generated assemblies at application startup, exploit requires attacker-controlled OpenAPI input.
- 7.5 /10 HighCVE-2026-63341 No auth
Aedes MQTT broker - Denial of Service
Aedes MQTT broker < 1.1.1 contains a denial of service caused by unbounded topic depth triggering an uncaught exception in qlobber, letting attackers disconnect all clients and crash the broker, exploit requires MQTT session establishment.
- 8.8 /10 HighCVE-2026-63339 Auth required
IXP Manager - Privilege Escalation
IXP Manager < 7.3.0 contains a privilege escalation caused by improper access control, letting authenticated non-administrative users elevate their privileges to administrator status, exploit requires user authentication.
- 8.3 /10 HighCVE-2026-63338 Auth required
IXP Manager - Broken Access Control
IXP Manager < 7.3.0 contains a broken access control caused by missing user_id verification in ApiKeyController, letting authenticated users view and edit other users' API keys, exploit requires authentication.
- 7.2 /10 HighCVE-2026-63224 Auth required
OpenRemote - SQL Injection
OpenRemote prior to 1.26.0 contains a SQL injection caused by improper escaping of asset and attribute names in the datapoint export API's CSV crosstab SQL query, letting authenticated users with asset creation and export permissions exfiltrate database data, exploit requires authenticated user with asset management and datapoint export permissions.
- 7.1 /10 HighCVE-2026-63201 Auth required
Netopeer2 - Denial of Service
Netopeer2 <= 2.8.7 contains a denial of service caused by improper format string handling in np2log(), letting low-privileged authenticated NETCONF users crash netopeer2-server remotely via crafted get RPC with invalid subtree filter.