High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 174 of 556
- 7.4 /10 HighCVE-2026-107318
@fastify/reply-from - Man-in-the-Middle
@fastify/reply-from < 12.7.0 contains a man-in-the-middle vulnerability caused by rejectUnauthorized being set to false in HTTPS transports, letting on-path attackers impersonate upstream servers and intercept data, exploit requires network attacker position.
- 7.6 /10 HighCVE-2026-107303 Auth required
JHipster - Stored XSS
JHipster prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0 contains a stored XSS caused by persisting attacker-controlled Blob data and ContentType values, letting authenticated users with write access execute active HTML or SVG under application origin, exploit depends on CSP and browser Blob behavior.
- 7.5 /10 HighCVE-2026-107302 No auth
msgpack5 - Denial of Service
msgpack5 prior to 6.1.0 contains a denial of service caused by improper validation of truncated map32 headers in the decoder, letting attackers cause unexpected termination of requests or streams, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-107300 No auth
msgpack5 - Denial of Service
msgpack5 prior to 6.1.0 contains a denial of service caused by recursive invocation of the streaming decoder on multiple small valid values in a chunk, letting remote attackers exhaust the JavaScript call stack, exploit requires sending crafted chunk with many values.
- 7.6 /10 HighCVE-2026-107295 No auth
Pydantic AI - Broken Access Control
Pydantic AI 1.34.0 to <1.107.4 and 2.28.0 contains a broken access control caused by missing request content-type validation in Agent.to_web() and clai chat endpoint, letting remote attackers execute tools with local process privileges, exploit requires attacker to submit crafted browser-compatible requests to loopback-hosted chat server.
- 7.5 /10 HighCVE-2026-107286 No auth
Pydantic AI - Denial of Service
Pydantic AI 2.10.0 to 2.53.0 contains a denial of service caused by concurrency slot retention in streamed requests via ConcurrencyLimitedModel or limit_model_concurrency, letting attackers block later requests, exploit requires use of shared concurrency limiter with streaming.
- 7.1 /10 HighCVE-2026-106611 No auth
WPMU DEV Forminator - Cross Site Request Forgery
WPMU DEV Forminator <= 1.57.3 contains a cross site request forgery vulnerability caused by insufficient request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.
- 8.8 /10 HighCVE-2026-106433 Auth required
MongoDB libmongocrypt - Out of Bounds Read/Write
MongoDB libmongocrypt contains an out-of-bounds memory access caused by improper state management when cleaning up key documents with duplicate masterKey fields, letting authenticated actors cause application termination or memory corruption, exploit requires ability to modify key vault documents.
- 7.7 /10 HighCVE-2026-105833 Auth required
EspoCRM - Broken Access Control
EspoCRM < 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service, letting users with Email Account scope retrieve other users' IMAP passwords, exploit requires knowledge of victim's Email Account record ID.
- 7.5 /10 HighCVE-2026-105830 No auth
league/commonmark - Denial of Service
league/commonmark > 2.0.0 < 2.10.2 contains a denial of service caused by quadratic-time complexity in TableStartParser::tryStart() block-start scan in GitHub Flavored Markdown Table extension, letting unauthenticated attackers exhaust CPU by submitting large pipe-free paragraphs.
- 8.7 /10 HighCVE-2026-105674 No auth
TP-Link Tapo - Authentication Bypass
TP-Link Tapo C325WB V2 contains a predictable pre-shared key generation caused by a time-seeded pseudo-random number generator in the local media streaming service, letting unauthenticated adjacent-network attackers recover the key and authenticate without valid credentials.
- 7.1 /10 HighCVE-2026-105673 No auth
Tapo C325WB - Denial of Service
Tapo C325WB v2 contains a denial-of-service vulnerability caused by crafted RTSP-over-HTTP tunneling requests in the RTSP streaming service on TCP port 554 when Camera Account feature is enabled, letting unauthenticated adjacent-network attackers disrupt live video streaming, exploit requires Camera Account feature enabled.
- 8.7 /10 HighCVE-2026-105672
TP-Link Tapo - Authorization Bypass
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass caused by manipulation of onboarding-scoped objects in the HTTPS JSON API dispatcher on TCP port 443, letting adjacent-network attackers invoke privileged actions without authentication.
- 8.8 /10 HighCVE-2026-105436 No auth
MainWP MainWP Child - Insecure Deserialization
MainWP MainWP Child <= 6.2.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires no special privileges.
- 7.6 /10 HighCVE-2026-105076 Auth required
Appsbd Vitepos - SQL Injection
Appsbd Vitepos vitepos-lite <= 3.6.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.