High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 175 of 556
- 7.4 /10 HighCVE-2026-104704
Progressive Robot hMailServer - Man-in-the-Middle
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a misconfiguration in TLS enforcement for outbound SMTP delivery caused by improper handling of DNSSEC-validated TLSA records, letting network attackers suppress STARTTLS and read or modify messages in cleartext, exploit requires active network position.
- 7.8 /10 HighCVE-2026-104660 Auth required
Progressive Robot hMailServer - Broken Access Control
Progressive Robot hMailServer 6.0.0 through 6.3.5 on Windows contains a broken access control vulnerability caused by missing authorization on COM objects, letting local users read/write arbitrary files and send mail as any sender without credentials, exploit requires local interactive access.
- 7.5 /10 HighCVE-2026-104659 No auth
Progressive Robot hMailServer - Authentication Bypass
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a broken authentication caused by missing Host header validation and lack of throttling on failed admin sign-ins in the REST API listener, letting remote attackers perform brute-force attacks via DNS rebinding, exploit requires attacker to control a web page opened in the administrator's browser.
- 7.8 /10 HighCVE-2026-104658 Auth required
Progressive Robot hMailServer - Privilege Escalation
Progressive Robot hMailServer 6.3.4 and 6.3.5 contain a privilege escalation caused by the live-update apply helper running as root and executing attacker-controlled files from the unprivileged service account, letting attackers with service account code execution escalate to root, exploit requires prior code execution as hmailserver service account.
- 7.8 /10 HighCVE-2026-104078 No auth
Obsidian Desktop - Command Injection
Obsidian Desktop < 1.14.0 contains a command injection caused by a filter bypass in MathJax 3.2.2 Safe component via crafted href with TAB byte, letting attackers execute arbitrary OS commands, exploit requires victim to click malicious link.
- 7.8 /10 HighCVE-2026-104077 No auth
Obsidian Desktop - Remote Code Execution
Obsidian Desktop < 1.14.0 contains a remote code execution caused by insufficient sanitization of the data-background-iframe attribute in Reveal.js 4.3.1 within the Slides core plugin, letting attackers execute arbitrary OS commands when victims open malicious Markdown notes and start presentations.
- 7.5 /10 HighCVE-2026-103649 No auth
Progressive Robot hMailServer - Denial of Service
Progressive Robot hMailServer 6.3.0 through 6.3.5 Linux builds contain a denial of service caused by missing network timeouts in socket handling, letting remote attackers hold server threads indefinitely, exploit requires sending crafted mail to trigger outbound delivery to attacker-controlled domains.
- 8.0 /10 HighCVE-2026-103647 No auth
Progressive Robot hMailServer - Stored XSS
Progressive Robot hMailServer 6.3.2 through 6.3.5 contains a stored XSS caused by unsafe rendering of decrypted S/MIME or OpenPGP message attachments as blob URLs in webmail, letting remote attackers execute scripts in the user's session, exploit requires REST API enabled.
- 7.5 /10 HighCVE-2026-103309 No auth
GPTranslate WordPress - Stored XSS
GPTranslate WordPress plugin < 2.34.14 contains a stored XSS caused by improper restriction and escaping of stored translations, letting unauthenticated attackers execute scripts on translated pages, exploit requires server-side translations enabled.
- 7.8 /10 HighCVE-2026-103010 Auth required
Progressive Robot hMailServer - Buffer Overflow
Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows contains a heap-based buffer overflow caused by unchecked long hexadecimal input in the BlowFishEncryptor::DecryptFromString routine, letting local users write beyond buffer limits, potentially causing denial of service or code execution, exploit requires local access without authentication.
- 8.7 /10 HighCVE-2026-102784 No auth
Joomla Extension balbooa.com Gridbox - Cross-Site Request Forgery
Joomla Extension balbooa.com Gridbox < 2.20.4.0 contains a cross-site request forgery caused by missing session token validation on GET requests in the addLanguage action, letting attackers perform unauthorized actions with victim's privileges, exploit requires victim to have core.tools permission.
- 8.7 /10 HighCVE-2026-102488 Auth required
Octopus Server - Broken Access Control
Octopus Server contains a broken access control caused by incorrect evaluation of multiple scoped permission assignments, letting highly privileged users obtain deployment permissions beyond their granted scope, exploit requires high privilege user access.
- 8.8 /10 HighCVE-2026-101024 Auth required
Satel Netco Design - Path Traversal
Satel Netco Design < 2.1.7 contains a path traversal caused by improper validation in data export functionality, letting authenticated users with Viewer privileges write files, potentially leading to unauthorized file modification or code execution.
- 8.7 /10 HighCVE-2026-97716 No auth
Secure Access - Denial of Service
Secure Access servers < 14.60 contain a denial of service caused by specially crafted traffic in the connection setup sub-system, letting unauthenticated attackers cause persistent service disruption, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-97715 Auth required
Secure Access - Denial of Service
Secure Access servers < 14.60 contain a denial of service vulnerability caused by malformed data in the client registration process, letting authenticated attackers cause persistent denial of service, exploit requires authentication.