High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 172 of 556
- 7.4 /10 HighCVE-2026-107724
fast-jwt - Authentication Bypass
fast-jwt 6.2.4 contains a broken authentication caused by misclassification of raw serialized public JWK or JWKS JSON as HMAC secret in src/crypto.js, letting attackers create tokens with arbitrary claims, exploit requires knowledge of exact serialized public-key bytes.
- 8.1 /10 HighCVE-2026-107723 Auth required
fast-jwt - Authentication Bypass
fast-jwt < 6.3.0 contains a broken authentication caused by accepting JSON array payloads in JWTs without proper claim validation, letting attackers bypass expiry, issuer, audience, subject, revocation, and replay protections, exploit requires attacker to produce or influence a validly signed token.
- 7.4 /10 HighCVE-2026-107720 No auth
fast-jwt - Authentication Bypass
fast-jwt < 6.3.1 contains an authentication bypass caused by accepting unsigned JWTs when key is empty or null and algorithms allowlist is non-empty, letting attackers bypass signature verification and submit arbitrary claims.
- 7.3 /10 HighCVE-2026-107716
Banks DirectoryPromptRegistry - Path Traversal
Banks DirectoryPromptRegistry < 2.5.1 contains a symbolic link handling vulnerability caused by lack of symlink rejection in index.json and .jinja prompt files, letting attackers with influence over the prompt directory read or overwrite external files, exploit requires attacker control over the registry directory or its contents.
- 7.8 /10 HighCVE-2026-107709 No auth
Bower decompress-zip - Path Traversal
Bower decompress-zip <= 0.3.3 contains a path traversal vulnerability caused by improper validation of archive entry paths in lib/decompress-zip.js, letting attackers overwrite arbitrary files during ZIP extraction, exploit requires crafted ZIP archive.
- 7.8 /10 HighCVE-2026-107707 Auth required
Intego Antivirus for Windows - Remote Code Execution
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in the optimization module, letting local unprivileged attackers delete arbitrary folders and execute code as SYSTEM by abusing Windows Installer rollback, exploit requires local access.
- 8.2 /10 HighCVE-2026-107701 No auth
dot-access - Prototype Pollution
dot-access contains a prototype pollution vulnerability caused by crafted dotted path input to set(), letting attackers modify Object.prototype to alter authorization flags, option defaults, or crash the process, exploit requires attacker control of input path.
- 8.8 /10 HighCVE-2026-107639 Auth required
ILIAS - Remote Code Execution
ILIAS < 9.24, 10.x < 10.12, and 11.x < 11.5 contain a command injection caused by improper sanitization of ImageMagick convert options in uploaded image filenames in assImagemapQuestionGUI, letting question authors execute remote code by writing PHP files under the web root, exploit requires question author privileges.
- 7.8 /10 HighCVE-2026-107615 Auth required
GlavSoft TightVNC Server - Remote Code Execution & Privilege Escalation
GlavSoft TightVNC Server for Windows < 2.8.88 contains an uncontrolled search path element vulnerability caused by loading DLLs without secure search flags, letting local authenticated users execute arbitrary code with SYSTEM privileges.
- 7.8 /10 HighCVE-2026-107612 Auth required
GlavSoft TightVNC Server - Broken Access Control
GlavSoft TightVNC Server for Windows < 2.8.88 contains an incorrect permission assignment caused by a NULL DACL on a named shared memory segment with predictable name, letting local authenticated users read or overwrite IPC handles, exploit requires local authentication.
- 7.1 /10 HighCVE-2026-107611
GlavSoft TightVNC Viewer - Out-of-Bounds Read
GlavSoft TightVNC Viewer for Windows < 2.8.88 contains an out-of-bounds read vulnerability caused by improper validation of palette indices in the ZRLE decoder, letting malicious VNC servers read heap memory and crash the viewer remotely, exploit requires a malicious or compromised VNC server.
- 7.5 /10 HighCVE-2026-107589 Auth required
Jacamar CI - Authentication Bypass
Jacamar CI < 0.30.0 contains an authentication bypass caused by insufficient job validation for service accounts, letting authenticated CI users generate arbitrary account names, exploit requires user authentication.
- 7.4 /10 HighCVE-2026-107584
Progressive Robot hMailServer - Man-in-the-Middle
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a misconfiguration in DANE implementation caused by improper DNSSEC validation in the DNS resolver, letting attackers on the DNS or SMTP path disable DANE and intercept or modify emails, exploit requires attacker to control or manipulate DNS responses and be active on SMTP path.
- 7.5 /10 HighCVE-2026-107579 No auth
Progressive Robot hMailServer - Denial of Service
Progressive Robot hMailServer 6.3.4 and 6.3.5 contain a denial of service caused by inefficient algorithmic complexity in bounce and complaint processing, letting remote unauthenticated attackers stop mail delivery by sending crafted messages, exploit requires bounce or complaint processing enabled or mailing list managed.
- 7.5 /10 HighCVE-2026-107577 No auth
Progressive Robot hMailServer - Denial of Service
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a denial of service caused by inefficient algorithmic complexity and a non-terminating loop in MIME processing, letting remote unauthenticated attackers make mail services unavailable by sending crafted messages, exploit requires sending specially crafted MIME headers.