High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 20 of 725
- 8.2 /10 HighCVE-2026-61586 No auth
Copernik XML Factory - XML External Entity Injection
Copernik XML Factory < 0.1.2 contains an XML External Entity Injection caused by lack of blocking XInclude resource resolution in stock JDK provider, letting attackers disclose local files or perform SSRF via crafted XML, exploit requires enabling XInclude and parsing untrusted XML.
- 7.5 /10 HighCVE-2026-59978
AdminNeo - Denial of Service
AdminNeo 4.6.2 to < 5.5.0 contains a denial of service caused by improper type validation in the unauthenticated ?script=version endpoint, letting remote attackers cause HTTP 500 errors by poisoning shared cache, exploit requires writable shared cache.
- 8.8 /10 HighCVE-2026-59387 Auth required
Cloud Controller - Authentication Bypass
Cloud Controller contains an authentication bypass caused by missing deny rule for /internal/v3/ endpoints in Nginx routing, letting attackers with a valid build or droplet GUID submit forged staging callbacks and escalate privileges, exploit requires valid build or droplet GUID.
- 8.2 /10 HighCVE-2026-58412 No auth
Filecoin Pin - Broken Access Control
Filecoin Pin < 1.1.0 contains a broken access control vulnerability caused by improper fork pull-request detection in upload GitHub Action, letting external contributors upload artifacts using the repository owner's wallet, exploit requires untrusted fork pull-request workflows.
- 7.1 /10 HighCVE-2026-54855 No auth
Profile Builder - Stored XSS
Profile Builder <= 4.0.5 contains an unauthenticated stored cross site scripting caused by improper input sanitization, letting remote attackers execute scripts without authentication.
- 7.1 /10 HighCVE-2026-48201 No auth
Fast Velocity Minify - Reflected XSS
Fast Velocity Minify <= 3.5.7 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-46560 No auth
Open Access Management OpenAM - Authentication Bypass
Open Access Management (OpenAM) < 16.1.1 contains an authentication bypass caused by improper validation of RADIUS responses in the authentication module, letting unauthenticated network attackers impersonate users, exploit requires network access to send forged UDP packets.
- 7.5 /10 HighCVE-2026-45145 Auth required
Chamilo LMS - Insecure Deserialization
Chamilo LMS < 2.0.1 contains an insecure deserialization caused by unsafe unserialize() usage on user_career.extra_data, letting attackers with write access to this data execute arbitrary OS commands, exploit requires ability to write crafted serialized objects.
- 8.9 /10 HighCVE-2026-45144 Auth required
Chamilo LMS - Stored XSS
Chamilo LMS 2.0.0 to 2.0.1 contains a stored XSS caused by unsanitized user-editable profile fields rendered with autoescape disabled, letting ROLE_STUDENT attackers execute scripts in visitors' browsers, exploit requires self-registration enabled.
- 8.6 /10 HighCVE-2026-40573 No auth
NovumOS - Privilege Escalation
NovumOS prior to 0.25-beta.1 contains a privilege escalation caused by the Nova interpreter running in Ring 0 without isolation, letting local users execute code with kernel privileges via malicious .nv scripts.
- 7.1 /10 HighCVE-2026-39786 No auth
BA Book Everything - Reflected XSS
BA Book Everything <= 1.8.33 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-39734 No auth
WP EasyPay - Path Traversal
WP EasyPay <= 4.5.4 contains a path traversal caused by improper input validation, letting unauthenticated attackers access arbitrary files, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-28160 No auth
VikRentCar - Stored XSS
VikRentCar <= 1.4.10 contains a stored XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.
- 8.7 /10 HighCVE-2026-22110 No auth
Web Server - Broken Authentication
The web server contains a broken authentication vulnerability caused by lack of authentication checks on POST or PUT requests, letting unauthenticated attackers reboot the charger and change settings by brute-forcing configid.
- 8.4 /10 HighCVE-2026-22109 Auth required
WebUI Template Database - Authentication Bypass
The WebUI template database contains a broken authentication vulnerability caused by retaining factory default passwords in cleartext for all five account types, letting attackers gain unauthorized access, exploit requires unchanged default credentials.