High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 171 of 556
- 8.0 /10 HighCVE-2026-15781 Auth required
IBM DataPower Gateway - Buffer Overflow
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a buffer overflow in an unspecified component, letting remote authenticated attackers execute arbitrary code.
- 7.4 /10 HighCVE-2026-14999 No auth
IBM DataPower Gateway - Authentication Bypass
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain an authentication bypass caused by improper verification of cryptographic JSON Web Signatures, letting remote attackers bypass authentication, exploit requires valid forged JSON Web Signatures.
- 8.2 /10 HighCVE-2026-14905 No auth
IBM DataPower Gateway - XML External Entity Injection
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contains an XML external entity injection caused by improper XML data processing, letting remote attackers expose sensitive information or cause memory resource consumption, exploit requires sending crafted XML data.
- 8.1 /10 HighCVE-2026-14888 No auth
IBM DataPower Gateway - Remote Code Execution
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a remote code execution caused by a heap-based buffer overflow, letting remote attackers execute arbitrary code remotely, exploit requires network access.
- 7.7 /10 HighCVE-2026-14507 Auth required
IBM DataPower Gateway - Denial of Service
IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 contains a denial of service caused by improper memory allocation during key derivation, letting remote authenticated attackers cause service disruption.
- 8.1 /10 HighCVE-2026-14497 Auth required
IBM DataPower Gateway - Authentication Bypass
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a broken authentication caused by improper verification of cryptographic signatures, letting remote authenticated attackers bypass security restrictions.
- 8.2 /10 HighCVE-2026-14496 No auth
IBM DataPower Gateway - Denial of Service
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a denial of service caused by a heap-based buffer overflow, letting remote attackers crash the system, exploit requires network access.
- 7.8 /10 HighCVE-2026-11318 PoC publicAuth required
Deskin - Privilege Escalation
Deskin through 3.3.4.3 contains a privilege escalation caused by lack of authentication in the com.deskin.service.installer XPC service, letting local unprivileged attackers execute arbitrary installer packages as root, exploit requires local access.
- 7.1 /10 HighCVE-2026-107802
SumatraPDF - Command Injection
SumatraPDF <= 3.6.1 contains a command injection caused by incomplete quote-only escaping in translation text embedding in Windows command lines, letting attackers inject CLI flags when specific backends are used, exploit requires agentic CLI backend installation.
- 7.8 /10 HighCVE-2026-107782 Auth required
System Informer - Broken Access Control
System Informer < 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper, letting local attackers execute code as SYSTEM by connecting from any Authenticode-signed process.
- 7.4 /10 HighCVE-2026-107781 No auth
Dromara Skyeye - Server-Side Request Forgery & Broken Access Control
Dromara Skyeye contains a server-side request forgery and missing authorization vulnerability in OnlyOffice save callback editUploadOfficeFileById, letting unauthenticated attackers fetch internal URLs and overwrite user files, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-107734 No auth
SumatraPDF - Command Injection
SumatraPDF <= 3.5.2 contains a command injection caused by unsafe substitution of attacker-controlled SyncTeX source filename in external editor command line, letting attackers inject command-line flags via crafted .synctex.gz files, exploit requires user to open PDF and invoke inverse search with configured external editor.
- 8.4 /10 HighCVE-2026-107732 No auth
SumatraPDF - Command Injection
SumatraPDF <= 3.6.1 contains a command injection caused by untrusted document paths and PDF link targets being interpreted as trusted tip markup in ParseTip(), letting attackers execute local programs in the user's context, exploit requires user interaction.
- 7.5 /10 HighCVE-2026-107728 No auth
Strawberry GraphQL - Broken Access Control
Strawberry GraphQL 0.217.0 < 0.326.1 contains a broken access control caused by improper handling of awaitable return values in synchronous PermissionExtension.resolve(), letting attackers bypass permission checks, exploit requires synchronous field resolvers with custom has_permission() returning awaitable.
- 8.7 /10 HighCVE-2026-107725 Auth required
Hazelcast - Remote Code Execution
Hazelcast < 5.4.5, < 5.5.10, and < 5.6.1 contain a remote code execution caused by missing authorization checks in the IMap Predicates API, letting malicious clients with limited privileges execute arbitrary code on cluster members, exploit requires client access with limited privileges.