High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 19 of 552
- 8.2 /10 HighCVE-2026-73790 No auth
HPE NonStop iTP WebServer - Denial of Service
HPE NonStop iTP WebServer contains a memory corruption vulnerability causing system shutdown, letting attackers cause denial of service, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-73261 No auth
Mongoose - Denial of Service
Mongoose < 7.23 contains a denial of service caused by improper TCP option length validation in src/net_builtin.c, letting unauthenticated remote peers corrupt MSS value and cause truncated payloads, exploit requires network access.
- 7.5 /10 HighCVE-2026-73260 No auth
Mongoose - Denial of Service
Mongoose < 7.23 contains a denial of service caused by improper length verification in the built-in TLS certificate parser, letting unauthenticated malicious TLS servers or clients trigger out-of-bounds reads during handshake.
- 7.5 /10 HighCVE-2026-73252 No auth
Mongoose - Denial of Service
Mongoose < 7.23 contains a denial of service caused by improper TLS 1.3 record size validation in mg_tls_recv_record(), letting unauthenticated malicious TLS peers trigger heap out-of-bounds read, exploit requires network access.
- 8.2 /10 HighCVE-2026-71854 No auth
OpenAEV - Broken Access Control
OpenAEV < 2.260622.0 contains a broken access control vulnerability caused by unauthenticated access to /api/player/** endpoints trusting client-supplied userId, letting unauthenticated attackers read and modify lessons data, exploit requires knowledge of exercise UUID.
- 8.8 /10 HighCVE-2026-71184 Auth required
Gitea - Broken Access Control
Gitea contains a broken access control vulnerability caused by pull request review notifier not attaching pull requests to Actions notifications, letting attackers execute fork-controlled workflow code on base repository runners without maintainer approval, exploit requires pull request review events.
- 8.1 /10 HighCVE-2026-66877 Auth required
Gitea - Broken Access Control
Gitea contains a broken access control vulnerability caused by improper re-checking of job approval in workflow dispatch, letting unreviewed workflow code execute on self-hosted runners, exploit requires fork contributor approval bypass.
- 8.8 /10 HighCVE-2026-63626 No auth
Mongoose - Buffer Overflow
Mongoose < 7.23 contains a buffer overflow caused by improper validation of the IPv6CP length field in ppp_handle_ipv6cp(), letting unauthenticated adjacent peers cause memory corruption or denial of service, exploit requires adjacent PPP or PPPoE link with specific features enabled.
- 7.1 /10 HighCVE-2026-61844 Auth required
FileRise - Broken Access Control
FileRise < 3.18.0 contains a broken access control vulnerability caused by metadata filename collisions due to path flattening, letting low-privileged users alter folder metadata to gain unauthorized read and edit access, exploit requires attacker to control a colliding folder and have read_own access.
- 8.2 /10 HighCVE-2026-61843 No auth
FileRise - Unrestricted File Upload
FileRise < 3.18.0 contains an insecure file upload vulnerability caused by failure to reject existing filenames in shared-folder and upload-only links, letting unauthenticated visitors with valid share tokens overwrite files silently, exploit requires valid share token and any configured share password.
- 7.4 /10 HighCVE-2026-57492 No auth
FileRise - Authentication Bypass
FileRise < 3.16.0 contains an authentication bypass caused by treating an empty or missing users.txt file as a fresh installation, letting unauthenticated remote attackers create an administrator account, exploit requires user store to be empty or missing.
- 8.1 /10 HighCVE-2026-57490 Auth required
FileRise - Authentication Bypass
FileRise < 3.16.0 contains a broken authentication caused by WebDAV Basic authentication bypassing TOTP enforcement, letting attackers with valid primary credentials access WebDAV without second factor, exploit requires valid primary credentials for TOTP-enabled account.
- 8.1 /10 HighCVE-2026-57489 No auth
FileRise - Authentication Bypass
FileRise < 3.16.0 contains an authentication bypass caused by trusting reverse-proxy identity headers without verifying request origin, letting unauthenticated attackers obtain sessions for arbitrary accounts including admin, exploit requires proxy-header authentication enabled and backend port exposure.
- 7.1 /10 HighCVE-2026-55787 Auth required
Flyto2 Core - Server Side Request Forgery
Flyto2 Core < 2.26.3 contains a server-side request forgery caused by improper validation of transition-form IP addresses in URL checks, letting authenticated workflow authors read internal services and cloud metadata via crafted URLs.
- 8.4 /10 HighCVE-2026-55786 CISA KEVNo auth
Flyto2 Core - Remote Code Execution
Flyto2 Core 2.26.2 to 2.26.4 contains a remote code execution caused by unauthenticated JSON-RPC requests forwarding execute_module arguments without authentication, letting unauthenticated attackers execute arbitrary OS commands, exploit requires network or local access to the MCP POST /mcp route.