High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 18 of 725
- 7.1 /10 HighCVE-2026-63184 No auth
Refitter - Server Side Request Forgery & File Inclusion
Refitter prior to 2.1.1 contains a server-side request forgery and file inclusion vulnerability caused by unsafe $ref resolution in NJsonSchema when processing attacker-controlled OpenAPI descriptions, letting remote attackers cause SSRF and local file disclosure, exploit requires attacker-controlled OpenAPI input.
- 8.1 /10 HighCVE-2026-63182
LightSAML - Authentication Bypass
LightSAML < 4.7.1 and < 5.0.1 contains an authentication bypass caused by signature validation mismatch in SAML assertion processing, letting attackers bypass authentication or escalate privileges by exploiting assertion signature confusion, exploit requires attacker to capture a genuine signed assertion.
- 8.7 /10 HighCVE-2026-62990 Auth required
Shopper - Stored XSS & Privilege Escalation
Shopper 2.0.0 to < 2.10.1 and 3.0.0-beta.1/beta.2 contain a stored XSS caused by executable media upload with insufficient MIME restrictions, letting authenticated back-office staff with content-upload permission execute scripts in admin sessions, exploit requires the administrator to open the uploaded file.
- 8.1 /10 HighCVE-2026-62989 Auth required
Shopper - Broken Access Control
Shopper < 2.10.0 contains a broken access control caused by missing server-side authorization in Variants Livewire component, letting authenticated staff users with edit_products permission delete product variants without delete_product_variants permission, exploit requires authenticated staff user with edit_products permission.
- 8.4 /10 HighCVE-2026-62979 Auth required
jack - Information Disclosure
jack before 0.1.0 contains an information disclosure caused by serialization of internal Radarr/Sonarr API keys and Cloudflare Access secrets in error responses, letting clients with shared peer API keys access sensitive credentials without user interaction.
- 8.7 /10 HighCVE-2026-62968 No auth
Dream Displays - Command Injection
Dream Displays 1.5.0 to 1.8.2 contains a command injection caused by user-controlled input influencing arguments passed to yt-dlp, letting attackers alter command behavior, exploit requires specific input conditions.
- 8.1 /10 HighCVE-2026-62967 Auth required
ZTNET - Authentication Bypass
ZTNET < 0.8.0 contains an authentication bypass caused by insufficient user ID verification in invalidateUser API, letting authenticated low-privilege users deactivate other accounts including administrators, exploit requires authenticated user with victim's user ID.
- 7.5 /10 HighCVE-2026-62966 No auth
ESPAsyncWebServer - Denial of Service
ESPAsyncWebServer < 3.11.2 contains a denial of service caused by improper handling of multipart parser buffer freeing in src/WebRequest.cpp, letting remote attackers cause device reboot via crafted upload, exploit requires a route with a non-trivial body/upload handler.
- 7.0 /10 HighCVE-2026-62965 Auth required
SABnzbd - Path Traversal
SABnzbd prior to 5.1.0Beta3 contains a path traversal caused by improper path confinement of user-controlled 'value' parameter in orphan-job management API, letting attackers with valid API keys delete writable files/directories, exploit requires valid API key.
- 7.9 /10 HighCVE-2026-62958 PoC publicNo auth
libriscv - Out-of-Bounds Read
libriscv < 1.18 contains an out-of-bounds read caused by improper validation of section-header offsets in binary loading, letting attackers crash the host or potentially disclose host memory, exploit requires crafted ELF binary.
- 7.5 /10 HighCVE-2026-62864 No auth
Ring - Regular Expression Denial of Service
Ring < 1.15.5 contains a regular expression denial of service caused by backtracking regex in wrap-nested-params middleware, letting attackers cause denial of service via crafted parameter names, exploit requires crafted parameter names.
- 7.3 /10 HighCVE-2026-62848 Auth required
Metalama Visual Studio - Insecure Deserialization
Metalama for Visual Studio 2023.0.101-rc to 2026.1.19 contains an insecure deserialization vulnerability caused by unrestricted CLR type instantiation in named-pipe messages, letting local same-user attackers execute arbitrary code, exploit requires local pipe write access.
- 8.2 /10 HighCVE-2026-62847 Auth required
Metalama - Privilege Escalation
Metalama.Framework and Metalama.Tool < 2025.1.18, 2026.0.25, 2026.1.19 contain a privilege escalation caused by loading and executing compile-time assemblies from predictable, world-writable temp directories on Linux/macOS, letting local unprivileged users escalate privileges by planting malicious DLLs, exploit requires shared machine or CI environment with multiple users.
- 8.7 /10 HighCVE-2026-62334 No auth
OpenVM zkVM - Authentication Bypass
OpenVM zkVM framework before 1.7.0 (1.x), 2.0 and 2.1 prereleases contains a broken authentication caused by improper verification in OpenVmHalo2Verifier.verify allowing arbitrary app commitments acceptance, letting attackers bypass proof validation, exploit requires crafted proofData with matching external selector.
- 8.7 /10 HighCVE-2026-62333
OpenVM - Authentication Bypass
OpenVM before 1.7.0 (1.x), 2.0.0-rc.3, and 2.1.0-preview contains a broken authentication caused by improper Merkle expansion row validation in MemoryMerkleAir, letting malicious provers alter committed memory roots without memory operations, exploit requires crafted Merkle subtree manipulation.