High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 201 of 568
- 7.3 /10 HighCVE-2026-79809 No auth
ClearPass Policy Manager - Path Traversal
ClearPass Policy Manager contains an unauthenticated path traversal vulnerability in an API endpoint, letting remote attackers influence authorization decisions and gain unintended roles, exploit requires no authentication.
- 7.8 /10 HighCVE-2026-79808 Auth required
ClearPass Policy Manager - Buffer Overflow
ClearPass Policy Manager contains a buffer overflow caused by improper handling in the OnGuard agent, letting authenticated local users execute arbitrary code with elevated privileges or cause denial of service.
- 7.8 /10 HighCVE-2026-79807 Auth required
ClearPass Policy Manager - Privilege Escalation
ClearPass Policy Manager Windows client contains a privilege escalation vulnerability caused by missing integrity verification, letting local malicious users execute code with elevated privileges, exploit requires local access.
- 7.8 /10 HighCVE-2026-79806 Auth required
ClearPass Policy Manager OnGuard Linux agent - Privilege Escalation
ClearPass Policy Manager OnGuard Linux agent contains a privilege escalation vulnerability caused by improper privilege management, letting malicious users escalate to root privileges on the Linux client, exploit requires local access.
- 8.8 /10 HighCVE-2026-79803 Auth required
ClearPass Policy Manager - Command Injection
ClearPass Policy Manager contains a command injection caused by improper input handling in the API, letting authenticated remote attackers escalate privileges and gain administrative control.
- 8.8 /10 HighCVE-2026-79802 No auth
ClearPass Policy Manager - Command Injection
ClearPass Policy Manager contains a command injection caused by crafted input in client software, letting attackers execute arbitrary commands with elevated privileges on the affected host, exploit requires attacker to supply crafted input.
- 8.8 /10 HighCVE-2026-79800 Auth required
ClearPass Policy Manager - Path Traversal & Privilege Escalation
ClearPass Policy Manager contains a path traversal caused by improper input validation in the command line interface, letting low-privileged authenticated remote attackers execute arbitrary code with elevated privileges.
- 8.8 /10 HighCVE-2026-79799 No auth
ClearPass Policy Manager - Stored XSS
ClearPass Policy Manager contains a stored XSS caused by improper input sanitization in the web-based management interface, letting unauthenticated remote attackers execute arbitrary script code in an admin's browser, exploit requires victim admin interaction.
- 8.8 /10 HighCVE-2026-79797 No auth
HPE Networking ClearPass Policy Manager - Broken Access Control
HPE Networking ClearPass Policy Manager Android client contains an improper access control vulnerability caused by untrusted sources invoking application functionality, letting unauthenticated remote attackers obtain sensitive information, exploit requires user interaction.
- 8.8 /10 HighCVE-2026-76748 Auth required
AOS-S - Privilege Escalation
AOS-S API contains a privilege escalation vulnerability allowing authenticated read-only users to escalate privileges and gain administrative access, exploit requires authenticated read-only user access.
- 7.7 /10 HighCVE-2026-76105 No auth
Dell Container Storage Modules - Data Tampering
Dell Container Storage Modules < 1.18.0 contain a use of insufficiently random values vulnerability, letting unauthenticated local attackers tamper with information, exploit requires local access.
- 7.2 /10 HighCVE-2026-75962 No auth
Post SMTP WordPress Plugin - Stored XSS
Post SMTP WordPress plugin <= 4.0.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of 'user_email' parameter, letting unauthenticated attackers inject scripts in email logs, exploit requires WordPress Multisite with public registration enabled.
- 7.3 /10 HighCVE-2026-71168 Auth required
Dell System Update - Remote Code Execution
Dell System Update < 2.3.0.0 contains a path traversal caused by improper limitation of pathname to restricted directory, letting low privileged local attackers execute code remotely, exploit requires local access.
- 7.1 /10 HighCVE-2026-70411 No auth
Dell Container Storage Modules - Broken Access Control
Dell Container Storage Modules (CSM) < 1.18.0 contains a missing authentication for critical function caused by lack of authentication in csm-authorization-tenant gRPC service, letting unauthenticated adjacent network attackers create tenants, inject roles, and modify storage access control flags.
- 7.5 /10 HighCVE-2026-70357 No auth
Gitea - Server Side Request Forgery
Gitea contains a server-side request forgery caused by hostname validation bypass in repository migration, letting attackers control DNS to reach blocked internal addresses during Git clone, exploit requires ability to start migration and control destination DNS.