High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 17 of 552
- 7.5 /10 HighCVE-2026-89073 No auth
Progress MOVEit Transfer - Authentication Bypass
Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4 contains an insufficient session expiration vulnerability caused by improper session timeout handling, letting attackers maintain access beyond intended session duration, exploit requires active session.
- 7.5 /10 HighCVE-2026-89072 Auth required
Progress MOVEit Transfer - Broken Access Control
Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 < 2026.0.4 contains an incorrect authorization vulnerability in the Client Certificates module, letting attackers bypass authorization controls, exploit requires attacker to interact with the authorization process.
- 7.5 /10 HighCVE-2026-89071 Auth required
Progress MOVEit Transfer - LDAP Injection
Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an LDAP injection caused by improper neutralization of special elements in LDAP queries, letting attackers manipulate LDAP queries remotely, exploit requires crafted LDAP input.
- 7.5 /10 HighCVE-2026-89070 No auth
Progress MOVEit Transfer - Authentication Bypass
Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an authentication bypass caused by capture-replay vulnerability in the OIDC module, letting attackers bypass authentication, exploit requires replaying captured authentication tokens.
- 8.0 /10 HighCVE-2026-89069 Auth required
Progress MOVEit Transfer - Stored XSS
Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4 contains a stored XSS caused by improper neutralization of input during web page generation in the Ad Hoc module, letting attackers execute scripts, exploit requires no special privileges.
- 8.1 /10 HighCVE-2026-89068 No auth
Progress MOVEit Transfer - Authentication Bypass
Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 < 2026.0.4 contains a broken authentication caused by a missing critical step in the LDAP module, letting attackers bypass authentication, exploit requires no special conditions.
- 8.8 /10 HighCVE-2026-89067 Auth required
Progress MOVEit Transfer - Authentication Bypass
Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an authentication bypass caused by use of alternate path or channel, letting attackers bypass authentication, exploit requires crafted request.
- 7.2 /10 HighCVE-2026-88829 No auth
BusyBox httpd - Path Traversal
BusyBox httpd contains a path traversal caused by improper path rewriting in reverse proxy feature, letting remote attackers access arbitrary backend paths, exploit requires crafted pipelined HTTP requests.
- 8.8 /10 HighCVE-2026-88164 Auth required
Microsoft Office SharePoint - Privilege Escalation
Microsoft Office SharePoint contains a broken access control caused by missing authorization checks, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-87093 Auth required
Progress MOVEit Transfer - Broken Access Control
Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an incorrect permission assignment for critical resource, letting attackers gain unauthorized access, exploit requires no special conditions.
- 8.8 /10 HighCVE-2026-86848 Auth required
DPDK lib/vhost - Out of Bounds Read/Write
DPDK lib/vhost vhost-crypto contains an out-of-bounds access caused by indirect-descriptor snapshot double-fetching a guest descriptor next index, letting malicious guests cause memory corruption, exploit requires malicious guest access.
- 8.8 /10 HighCVE-2026-86799 No auth
Forms WordPress - Stored XSS
Forms WordPress plugin < 3.0.2 contains a stored XSS caused by lack of sanitization and escaping of submitted form values, letting unauthenticated attackers execute arbitrary scripts in admin dashboard, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-86787 Auth required
Affiliate-Toolkit WordPress plugin - Remote Code Execution
Affiliate-Toolkit WordPress plugin < 3.9.1 contains a remote code execution caused by insufficient template body validation in its templating engine, letting users with Contributor role or above execute arbitrary PHP code on the server, exploit requires Contributor or higher privileges.
- 8.8 /10 HighCVE-2026-86567 Auth required
DPDK lib/vhost - Use After Free
DPDK lib/vhost contains a use-after-free vulnerability caused by failure to invalidate vring pointers when the IOTLB is invalidated, letting attackers cause memory corruption, exploit requires no special conditions.
- 8.2 /10 HighCVE-2026-86565 Auth required
DPDK - Out of Bounds Read/Write
DPDK lib/vhost contains an out-of-bounds write caused by desynchronization of virtqueue size from inflight descriptor table size, letting guest attackers corrupt host memory, exploit requires guest access.