High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 182 of 556
- 7.2 /10 HighCVE-2026-107207 No auth
LMCache - Server Side Request Forgery
LMCache <= 0.5.5 contains a server-side request forgery caused by improper validation in the frontend monitoring service, letting unauthenticated attackers bypass proxy allowlist to access internal hosts and tamper nodes, exploit requires ability to register arbitrary hosts via POST /api/proxies.
- 8.6 /10 HighCVE-2026-107205 No auth
LMCache - Authentication Bypass
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator's HTTP fleet control API, letting remote unauthenticated attackers access and manipulate instances, quotas, events, and directory keys, exploit requires default API exposure on all interfaces.
- 8.1 /10 HighCVE-2026-107183 No auth
llama.cpp - Use After Free
llama.cpp before b11393 contains a use-after-free and double free vulnerability caused by a dangling current_tool pointer in common_chat_peg_mapper::map, letting unauthenticated remote attackers corrupt heap memory via crafted POST /completion requests.
- 8.1 /10 HighCVE-2026-107181 PoC publicNo auth
Telegram Desktop - Authentication Bypass
Telegram Desktop < 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox, letting remote attackers inject OPEN: records via crafted tg:// links to upload local files and enable account takeover, exploit requires crafted tg:// links with unescaped semicolons.
- 7.1 /10 HighCVE-2026-107180 Auth required
MISP - Authentication Bypass
MISP < 2.5.48 contains a broken authentication caused by improper enforcement of mandatory TOTP two-factor authentication on non-browser requests, letting authenticated users bypass TOTP enrollment and retain full access, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-107161
Cyrus SASL - Buffer Overflow
Cyrus SASL contains a heap-based buffer overflow caused by incorrect buffer size calculation in the DIGEST-MD5 plugin's add_to_challenge() function, letting malicious or on-path servers crash the client by supplying crafted challenge fields, exploit requires attacker-controlled server.
- 7.1 /10 HighCVE-2026-106560 Auth required
Backstage @backstage/plugin-scaffolder-backend-module-confluence-to-markdown - Path Traversal
Backstage @backstage/plugin-scaffolder-backend-module-confluence-to-markdown < 0.3.25 contains a path traversal caused by improper repository path validation in scaffolder backend module, letting authenticated users write generated content outside task workspace, exploit requires authentication and template execution.
- 8.8 /10 HighCVE-2026-106558 Auth required
Backstage - Remote Code Execution
Backstage @backstage/plugin-techdocs-node < 1.14.8, < 1.15.6, and < 2.0.1 contains a remote code execution caused by improper validation of mapping-style markdown_extensions configuration, letting authenticated attackers bypass sanitization and execute arbitrary code during documentation generation, exploit requires attacker to register or influence SCM-backed documentation source.
- 7.7 /10 HighCVE-2026-106557 Auth required
Backstage @backstage/plugin-techdocs-node - Broken Access Control
Backstage @backstage/plugin-techdocs-node < 1.14.6 and < 1.15.4 contains an information disclosure caused by insufficient validation of TechDocs Markdown extension configuration, letting authenticated users access resources outside intended documentation boundaries, exploit requires authenticated user with documentation source modification privileges.
- 7.7 /10 HighCVE-2026-106556 Auth required
Backstage @backstage/plugin-techdocs-node - Command Injection
Backstage @backstage/plugin-techdocs-node < 1.14.6 contains a command injection caused by insufficient validation of MkDocs configuration in techdocs mkdocs.yml sanitization, letting authenticated users who can register or modify documentation sources execute arbitrary commands in the build environment.
- 7.7 /10 HighCVE-2026-106510 Auth required
Backstage @backstage/plugin-techdocs-node - Remote Code Execution
Backstage @backstage/plugin-techdocs-node < 1.14.6 contains a remote code execution caused by crafted markdown_extensions in techdocs mkdocs.yml, letting authenticated users who can register catalog entities execute arbitrary OS commands on the TechDocs build host, exploit requires authenticated user with catalog entity registration rights.
- 8.1 /10 HighCVE-2026-106471 Auth required
Candlepin - Broken Access Control
Candlepin contains a broken access control caused by incorrect authorization filter logic in @Verify-annotated parameters, letting low-privilege authenticated attackers bypass authorization to disclose and modify subscription data.
- 7.3 /10 HighCVE-2026-106164 No auth
In Progress Telerik Document Processing - Denial of Service
In Progress Telerik Document Processing SpreadProcessing library < 2026.3.1006 contains a denial of service caused by infinite loop when importing a specifically corrupted XLS file, letting attackers cause unresponsive CPU thread, exploit requires crafted XLS file.
- 8.8 /10 HighCVE-2026-106059 No auth
GitAhead - Command Injection
GitAhead through 2.7.1 on macOS contains a command injection caused by unescaped repository filenames interpolated into Show in Finder AppleScript, letting attackers execute shell commands as the victim user, exploit requires crafted repository filenames.
- 7.5 /10 HighCVE-2026-106058 No auth
GitAhead - Command Injection
GitAhead through 2.7.1 contains a command injection caused by crafted filenames substituted into clean/smudge filter commands in src/git/Filter.cpp, letting attackers execute arbitrary OS commands during checkout or staging, exploit requires malicious repository with crafted filenames.