High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 20 of 552
- 8.1 /10 HighCVE-2026-55682 No auth
WeGIA - Authentication Bypass
WeGIA < 3.8.6 contains a session fixation vulnerability caused by reflection of attacker-supplied PHPSESSID cookie and use of DB_HOST as cookie domain, letting attackers hijack authenticated sessions and disclose internal DB host, exploit requires victim authentication with attacker-chosen session ID.
- 8.8 /10 HighCVE-2026-55681 Auth required
WeGIA - SQL Injection
WeGIA < 3.8.6 contains a SQL injection caused by a second extract($_REQUEST) overwriting sanitized id_produto in web/html/matPat/restaurar_produto_desocultar.php, letting authenticated users execute arbitrary SQL to extract or modify data.
- 7.2 /10 HighCVE-2026-55387 Auth required
InvoiceShelf - Broken Access Control
InvoiceShelf <= 2.3.3 contains a broken access control vulnerability caused by insufficient validation of record identifiers in bulk-delete requests, letting authenticated users delete records from other companies, exploit requires authentication.
- 7.1 /10 HighCVE-2026-55386 Auth required
InvoiceShelf - SQL Injection
InvoiceShelf < 2.4.0 contains a SQL injection caused by unsanitized orderByField parameter in Laravel orderBy calls in Invoice::scopeApplyFilters, letting authenticated attackers perform boolean-based blind SQL injection, exploit requires authentication.
- 8.2 /10 HighCVE-2026-55383 No auth
InvoiceShelf - Broken Access Control
InvoiceShelf < 2.4.0 contains an information disclosure caused by improper verification of EmailLog token's mailable_type and expiration in public customer invoice, estimate, and payment routes, letting attackers access other companies' documents and use expired tokens, exploit requires crafted token with numeric identifier collision.
- 7.6 /10 HighCVE-2026-55382 Auth required
InvoiceShelf - Broken Access Control
InvoiceShelf < 2.4.0 contains a broken access control vulnerability caused by improper authorization checks in NotesController methods, letting authenticated staff users access and modify notes of other companies, exploit requires authenticated staff user privileges.
- 7.1 /10 HighCVE-2026-55381 Auth required
InvoiceShelf - Broken Access Control
InvoiceShelf < 2.4.0 contains a broken access control caused by improper authorization of route-bound Estimate in ConvertEstimateController, letting authenticated users with create-invoice ability copy and modify other companies' invoice data, exploit requires authenticated user with create-invoice ability.
- 7.3 /10 HighCVE-2026-54702 No auth
Markdown Preview Enhanced - Command Injection
Markdown Preview Enhanced < 0.8.30 contains a command injection caused by unvalidated attacker-controlled command and args in the webview message handler, letting attackers execute privileged extension commands, exploit requires prior webview JavaScript execution.
- 8.5 /10 HighCVE-2026-54566 No auth
Markdown Preview Enhanced - Command Injection
Markdown Preview Enhanced < 0.8.29 contains a command injection caused by unsafe evaluation of repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, letting attackers execute OS commands as the victim user, exploit requires opening a Markdown file in a malicious repository.
- 7.5 /10 HighCVE-2026-54554 No auth
FOG - Information Disclosure
FOG < 1.5.10.1870 contains an information disclosure vulnerability caused by the management adInfo() endpoint returning default domain-join credentials in the domainpass JSON field without authentication, letting remote unauthenticated attackers access sensitive credentials.
- 8.8 /10 HighCVE-2026-54525 No auth
Markdown Preview Enhanced - Command Injection
Markdown Preview Enhanced < 0.8.28 contains a command injection caused by unsafe handling of decoded Markdown-controlled link targets in Windows file-opening helper, letting attackers execute arbitrary commands with user privileges, exploit requires a user to click a crafted preview-link.
- 7.7 /10 HighCVE-2026-53999 Auth required
Radius - Broken Access Control
Radius < 0.58.0 contains a broken access control caused by deserialization of user-controlled radapp.io/status annotation without ownership verification, letting attackers with Deployment annotation modification permissions delete other tenants' container resources, exploit requires permission to modify Deployment annotations and knowledge of target Radius resource ID.
- 8.0 /10 HighCVE-2026-53615 No auth
util-linux - Data Tampering
util-linux < 2.41.4 contains a partition metadata integrity compromise caused by 32-bit addition overflow and missing bounds checks in parse_dos_extended(), letting local attackers cause false overlapping partition reports, exploit requires crafted DOS extended-partition disk image.
- 7.0 /10 HighCVE-2026-53614 Auth required
util-linux - Privilege Escalation
util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1 contain a privilege escalation caused by unsafe handling of LIBMOUNT_FORCE_MOUNT2 environment variable in the SUID mount utility, letting local low-privileged users gain root privileges by exploiting a race condition with bind mounts, exploit requires authorized /etc/fstab bind mount with specific options.
- 7.0 /10 HighCVE-2026-53613 PoC publicAuth required
util-linux - Privilege Escalation
util-linux 2.17 through 2.41.6, 2.42 through 2.42.3, and 2.42.4 with legacy mount path without /proc contains a privilege escalation caused by improper validation of /etc/fstab targets allowing local low-privileged users to redirect mounts to root-owned locations, letting attackers gain root privileges, exploit requires fstab user or users entry with attacker-writable ancestor.