High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 19 of 725
- 8.2 /10 HighCVE-2026-62331 No auth
Praktor - Path Traversal
Praktor < 0.9.1 contains a path traversal vulnerability caused by unsanitized document filename concatenation in Telegram upload sites, letting remote Telegram users write arbitrary files in the agent workspace, exploit requires messaging the bot.
- 8.7 /10 HighCVE-2026-62302 No auth
MyTube - Authentication Bypass
MyTube prior to version 1.10.3 contains an authentication bypass caused by middleware registration order in server.ts, letting unauthenticated clients access protected media routes, exploit requires loginEnabled=true.
- 7.1 /10 HighCVE-2026-62301 Auth required
MyTube - Broken Access Control
MyTube prior to version 1.10.3 contains an information disclosure caused by missing role and visibility checks in backend video access, letting visitors retrieve hidden video metadata and media files without authentication, exploit requires loginEnabled=true with visitor password configured.
- 7.5 /10 HighCVE-2026-62297 No auth
ag-psd - Denial of Service
ag-psd before 31.0.0 contains a denial of service caused by unvalidated attacker-declared PSD geometry leading to excessive memory allocation in psdReader.js, letting attackers exhaust memory remotely, exploit requires crafted PSD input.
- 8.6 /10 HighCVE-2026-62284 Auth required
OSAC operator - Command Injection & Server-Side Request Forgery
OSAC operator 8220502 contains a command injection caused by unsanitized exec credential plugin in kubeconfig Secrets parsed by console-proxy RemoteConfigResolver, letting attackers spawn arbitrary processes and perform SSRF, exploit requires Secret read access via RoleBinding.
- 7.5 /10 HighCVE-2026-62264 No auth
PDF Reader MCP - Authentication Bypass
PDF Reader MCP 2.2.0 to < 3.0.1 contains an authentication bypass caused by missing validation of X-API-Key header in HTTP server, letting unauthenticated clients access PDF tools and read files, exploit requires HTTP transport enabled.
- 8.2 /10 HighCVE-2026-62162 No auth
Hydra - Broken Access Control
Hydra prior to 2.1.0 contains a broken access control vulnerability caused by missing constraints on spending the Head state-token UTxO in deposit validator, letting third parties consume pending deposit UTxOs and redirect assets before the deposit deadline, exploit requires ability to build Cardano transactions.
- 8.7 /10 HighCVE-2026-62160 No auth
Daptin - Denial of Service
Daptin < 0.12.26 contains a denial of service caused by improper validation of Accept-Language headers in LanguageMiddleware, letting unauthenticated attackers cause high CPU usage via crafted headers, exploit requires sending large malformed headers.
- 8.2 /10 HighCVE-2026-61854 No auth
VoiceSentinel - Race Condition
VoiceSentinel 2.2.1 to 3.3.1 contains a race condition in the report buffer feature caused by unsynchronized concurrent writes and cleanups in transcript handling, letting attackers cause data corruption and unbounded disk growth, exploit requires report buffer enabled and concurrent processing.
- 8.9 /10 HighCVE-2026-61845 No auth
Crass - Denial of Service
Crass < 1.0.7 contains a denial of service caused by unbounded exponentiation in CSS scientific notation number parsing, letting attackers cause high CPU and memory usage, exploit requires attacker-controlled CSS input.
- 8.1 /10 HighCVE-2026-61804 Auth required
myTinyWMS - Stored XSS
myTinyWMS < 1.6.4 contains a stored XSS caused by inadequate backend sanitization of 'name' parameter in product and category management, letting authenticated attackers execute scripts in other users' browsers, exploit requires authentication.
- 7.5 /10 HighCVE-2026-61739 No auth
SOCFortress CoPilot - Broken Access Control
SOCFortress CoPilot < 0.1.77 contains a broken access control vulnerability caused by missing role and tenant authorization in Velociraptor Sigma exclusion-management endpoints, letting authenticated customer users suppress detections and manage exclusions across tenants, exploit requires authenticated customer user.
- 8.5 /10 HighCVE-2026-61708 Auth required
SOCFortress CoPilot - Unrestricted File Upload
SOCFortress CoPilot < 0.1.76 contains an unrestricted file upload vulnerability caused by lack of allowlist, tenant prefix, ownership check, or content restriction in POST /api/agent_data_store/upload, letting low-privilege customer_user attackers overwrite cross-tenant files, exploit requires attacker to have customer_user privileges.
- 7.3 /10 HighCVE-2026-61627 No auth
libass - Denial of Service
libass < 0.17.5 contains a buffer overread and overwrite caused by improper handling of glyph arrays in wrap_lines_measure during rendering of malicious ASS content, letting attackers cause denial of service, exploit requires crafted subtitle content.
- 7.3 /10 HighCVE-2026-61626 No auth
libass - Denial of Service
libass 0.17.4 contains a denial of service caused by lack of guard for negative Matroska ReadOrder values in event pruning, letting attackers cause crashes via malicious Matroska streams, exploit requires enabled read-order checking and event pruning.