High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 173 of 556
- 7.5 /10 HighCVE-2026-107576 No auth
Progressive Robot hMailServer - Denial of Service
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a denial of service vulnerability caused by inefficient algorithmic complexity in inbound DKIM and ARC signature verification, letting remote unauthenticated attackers make mail services unavailable by sending crafted messages.
- 7.5 /10 HighCVE-2026-107574 No auth
Progressive Robot hMailServer - Denial of Service
Progressive Robot hMailServer contains a denial of service caused by inefficient algorithmic complexity in the JSON reader, letting remote unauthenticated attackers make mail services unavailable by sending crafted large JSON objects, exploit requires sending large crafted TLS-RPT reports or JSON bodies.
- 7.8 /10 HighCVE-2026-107573 Auth required
Progressive Robot hMailServer - Broken Access Control
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains an information disclosure vulnerability caused by incorrect default permissions on installer-created files and folders, letting local authenticated users read sensitive mail server data, exploit requires local user access.
- 7.1 /10 HighCVE-2026-107503 No auth
Eclipse Ditto Ditto Explorer - Authentication Bypass
Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] contains an OAuth authorization code and PKCE verifier theft vulnerability caused by unvalidated environment URLs allowing injected OIDC authority, letting attackers take over accounts by redeeming tokens, exploit requires crafted link with attacker-controlled OIDC authority and autoSso enabled.
- 7.4 /10 HighCVE-2026-107385
MariaDB Connector/Node.js - SQL Injection
MariaDB Connector/Node.js < 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contains a SQL injection caused by improper text-protocol escaping that ignores NO_BACKSLASH_ESCAPES mode, letting attackers inject arbitrary SQL with database privileges, exploit requires vulnerable sql_mode enabled.
- 8.1 /10 HighCVE-2026-107384 No auth
MariaDB Connector/Node.js - SQL Injection
MariaDB Connector/Node.js 3.2.0 to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contains a SQL injection caused by unescaped keys in permitSetMultiParamEntries option expanding into SQL SET clause, letting attackers execute arbitrary SQL with database user privileges, exploit requires permitSetMultiParamEntries enabled.
- 7.5 /10 HighCVE-2026-107383 No auth
MariaDB Connector/Node.js - Information Disclosure
MariaDB Connector/Node.js < 3.2.5, < 3.3.4, < 3.4.7, and < 3.5.4 contains an information disclosure caused by improper validation of GeoJSON Polygon and MultiPolygon rings in binary encoders, letting attackers disclose uninitialized Node.js heap data via database values, exploit requires sending malformed non-array rings.
- 8.7 /10 HighCVE-2026-107378 No auth
CairoSVG - Denial of Service
CairoSVG < 2.9.1 contains a denial of service caused by inefficient path processing in path.py, letting attackers cause high CPU consumption by rendering crafted SVGs, exploit requires attacker to provide malicious SVG input.
- 7.5 /10 HighCVE-2026-107377 No auth
datamodel-code-generator - Path Traversal
datamodel-code-generator 0.59.0 to 0.81.0 contains a path traversal caused by attacker-controlled Protobuf schema paths processed by _write_missing_weak_imports, letting attackers create or overwrite files, exploit requires processing Protobuf schema with grpcio-tools.
- 8.2 /10 HighCVE-2026-107376 No auth
webonyx graphql-php - Denial of Service
webonyx graphql-php < 15.32.3 contains a denial of service caused by lack of recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference, letting remote attackers exhaust PHP process stack, exploit requires crafted deeply nested queries.
- 8.8 /10 HighCVE-2026-107375 Auth required
JHipster - SQL Injection
JHipster 7.0.0 to 9.4.0 contains a SQL injection caused by unvalidated attacker-controlled sort parameters in reactive applications using Spring WebFlux and R2DBC, letting authenticated users read, modify, or delete data.
- 7.1 /10 HighCVE-2026-107362 Auth required
Malcolm file-upload - Information Disclosure
Malcolm file-upload component with pqina/filepond-server-php contains an insecure fetch API route in index.php caused by unrestricted URL download via curl, letting remote attackers read arbitrary remote content, exploit requires network access.
- 7.1 /10 HighCVE-2026-107337 No auth
Malcolm kiosk Flask - Cross Site Request Forgery
Malcolm kiosk Flask application contains a cross site request forgery caused by unauthenticated POST /script_call/<script> endpoint with wildcard CORS, letting attackers force operator's browser to execute arbitrary management commands, exploit requires operator browser interaction.
- 8.1 /10 HighCVE-2026-107333 Auth required
Malcolm nginx - Broken Access Control
Malcolm nginx based reverse proxy contains a broken access control caused by URL path normalization inconsistency between Lua RBAC layer and nginx routing, letting authenticated users bypass role restrictions to access admin endpoints.
- 7.8 /10 HighCVE-2026-107322 No auth
Amazon Agent Plugins databases-on-aws - Command Injection
Amazon Agent Plugins databases-on-aws plugin < 1.7.1 contains a command injection caused by incomplete input validation in database command values, letting remote unauthenticated attackers execute arbitrary OS commands, exploit requires crafted database command.