High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 181 of 556
- 7.7 /10 HighCVE-2026-107352 Auth required
Amazon Athena - Broken Access Control
Amazon Athena engine version 3 contains a broken access control vulnerability caused by missing authorization checks in request handling, letting authenticated users read limited query metadata from other AWS accounts, exploit requires user authentication.
- 7.6 /10 HighCVE-2026-107281 Auth required
AsyncHttpClient - Broken Access Control
AsyncHttpClient < 3.0.13 and < 2.16.1 contains a broken access control caused by HTTP/1.1 connection-pool key excluding authenticated principal for NTLM and Negotiate authentication, letting attackers reuse authenticated sockets as another identity, exploit requires use of connection-oriented NTLM or Negotiate authentication.
- 8.8 /10 HighCVE-2026-107279 No auth
AsyncHttpClient - Authentication Bypass
AsyncHttpClient 3.0.12 contains an authentication bypass caused by improper handling of Digest qop=auth-int in mutual-authentication verification, letting attackers impersonate authenticated servers, exploit requires crafted server response.
- 7.1 /10 HighCVE-2026-107270 Auth required
Gophish - Broken Access Control
Gophish <= 0.12.1 contains an insecure direct object reference vulnerability caused by insufficient authorization checks in API endpoints, letting authenticated users take over other users' groups, templates, landing pages, and sending profiles by supplying another user's sequential ID.
- 7.5 /10 HighCVE-2026-107232
AsyncHttpClient - Authentication Bypass
AsyncHttpClient < 3.0.12 (3.x) and < 2.16.1 (2.x) contains an information disclosure caused by improper handling of proxy CONNECT rejection, letting attackers recover or relay credentials over plaintext proxy connections, exploit requires use of HTTP proxy with CONNECT rejection.
- 8.7 /10 HighCVE-2026-107231
AsyncHttpClient - Authentication Bypass
AsyncHttpClient < 3.0.13 and < 2.16.1 contains an authentication bypass caused by treating Digest challenges with no usable nonce as Basic challenges, letting attackers cause clients to resend credentials in Basic auth, exploit requires attacker to control origin or proxy.
- 7.4 /10 HighCVE-2026-107230 No auth
AsyncHttpClient - Broken Access Control
AsyncHttpClient 2.0.0 to 3.0.14 contains a broken access control vulnerability caused by connection-pool partitioning omitting identity-defining fields for various authentication methods, letting attackers access data or authority of other identities, exploit requires use of authenticated proxy or Kerberos/SPNEGO/NTLM logins.
- 7.5 /10 HighCVE-2026-107227 No auth
AsyncHttpClient - Denial of Service
AsyncHttpClient 2.2.0 to 3.0.14 contains a denial of service caused by unbounded WebSocket permessage-deflate decompression, letting malicious WebSocket peers exhaust JVM heap, exploit requires compression enabled.
- 7.5 /10 HighCVE-2026-107223 PoC publicNo auth
Excelize - Denial of Service
Excelize 2.1.0 to 2.11.0 contains a denial of service caused by improper validation of column range limits in flatCols, letting attackers consume excessive CPU and memory via crafted worksheet columns, exploit requires invoking a column mutator.
- 7.5 /10 HighCVE-2026-107219 PoC publicNo auth
Excelize - Denial of Service
Excelize 2.3.1 to 2.11.0 contains a denial of service caused by unbounded spinCount in agile decryption key derivation, letting attackers consume CPU resources indefinitely, exploit requires crafted OLE encrypted workbook.
- 7.5 /10 HighCVE-2026-107217 PoC publicNo auth
Excelize - Denial of Service
Excelize 2.0.0 to 2.11.0 and 1.1.0 to 1.4.1 contains a denial of service caused by integer overflow in ColumnNameToNumber leading to negative slice index panic during worksheet normalization, letting attackers terminate the process, exploit requires crafted worksheet with long column name.
- 7.5 /10 HighCVE-2026-107216 PoC publicNo auth
Excelize - Denial of Service
Excelize 2.8.1 to 2.11.0 contains a stack overflow caused by recursive calls to CalcCellValue in ANCHORARRAY bypassing cycle controls, letting attackers cause fatal Go stack overflow, exploit requires crafted mutually referencing dynamic-array formulas.
- 7.5 /10 HighCVE-2026-107215 PoC publicNo auth
Excelize - Denial of Service
Excelize 2.3.1 to 2.11.0 contains a denial of service caused by improper validation of CFB directory-entry sizes in extractPart, letting attackers cause panic or memory exhaustion via crafted OLE files, exploit requires crafted file input.
- 7.5 /10 HighCVE-2026-107214 PoC publicNo auth
Excelize - Denial of Service
Excelize 2.3.1 to 2.11.0 contains a denial of service caused by insufficient validation in decryption dispatch leading to Go runtime panics when processing malformed OLE compound files, letting attackers terminate the process, exploit requires crafted malicious files.
- 7.5 /10 HighCVE-2026-107212 PoC publicNo auth
Excelize - Denial of Service
Excelize 2.1.0 to 2.11.0 contains a denial of service caused by improper row number limit checks in Rows.Columns and Rows.Next, letting attackers consume CPU resources by crafted worksheets, exploit requires processing crafted Excel files.