High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 208 of 568

  • 7.7 /10 High
    CVE-2026-106498 Auth required

    Backstage @backstage/plugin-catalog-backend - Broken Access Control

    Backstage @backstage/plugin-catalog-backend < 3.5.1, 3.6.2, 3.7.2, 3.8.2, 3.9.1 contains an information disclosure caused by improper URL validation in catalog entity placeholder resolution, letting authenticated users access unintended data under certain configurations, exploit requires user authentication.

  • 7.6 /10 High
    CVE-2026-106492

    Backstage @backstage/backend-defaults - Broken Access Control

    Backstage @backstage/backend-defaults < 0.16.1 and < 0.17.8 contains a broken access control caused by improper preservation of access restrictions during service credential delegation, letting external services bypass restrictions and perform unauthorized operations, exploit requires configured service credentials with access restrictions.

  • 8.1 /10 High
    CVE-2026-106488 Auth required

    Backstage @backstage/plugin-auth-backend-module-oidc-provider - Authentication Bypass

    Backstage @backstage/plugin-auth-backend-module-oidc-provider < 0.4.20 contains an authentication bypass caused by improper handling of unverified email addresses in OIDC provider, letting authenticated provider users assume other catalog identities, exploit requires OIDC email-based identity resolution with unverified emails allowed.

  • 8.5 /10 High
    CVE-2026-106486 Auth required

    Backstage @backstage/plugin-scaffolder-backend-module-bitbucket - Path Traversal

    Backstage @backstage/plugin-scaffolder-backend-module-bitbucket-cloud < 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server < 0.2.25 contain a path traversal caused by insufficient validation of filesystem paths in Bitbucket pull-request Scaffolder actions, letting authenticated users affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability.

  • 8.5 /10 High
    CVE-2026-106459 Auth required

    Backstage @backstage/plugin-scaffolder-backend-module-sentry - Information Disclosure

    Backstage @backstage/plugin-scaffolder-backend-module-sentry 0.3.0 to 0.3.8 contains an information disclosure vulnerability caused by improper input validation in sentry scaffolder actions, letting authenticated internal users disclose Sentry integration credentials, exploit requires authenticated internal user privileges.

  • 7.7 /10 High
    CVE-2026-106455 Auth required

    Backstage @backstage/plugin-techdocs-node - Server Side Request Forgery

    Backstage @backstage/plugin-techdocs-node 0.11.12 to 1.14.7 and 1.15.5 contains a server-side request forgery caused by improper validation of mkdocs plugin configuration in TechDocs, letting authenticated attackers cause documentation builds to retrieve and publish data from network locations, exploit requires authenticated access to TechDocs source repository.

  • 7.3 /10 High
    CVE-2026-106451

    yawkat LZ4 Java - Race Condition & Native Code Execution

    yawkat LZ4 Java 1.7.0 to 1.11.4 contains a race condition in native library loading caused by predictable temporary file paths, letting local attackers execute native code by replacing the library file, exploit requires shared temporary directory access.

  • 8.9 /10 High
    CVE-2026-106448 No auth

    StableLib @stablelib/cbor - Prototype Pollution

    StableLib @stablelib/cbor < 2.0.4 contains a prototype pollution caused by unsafe assignment of attacker-controlled __proto__ keys during CBOR map decoding, letting attackers manipulate object prototypes, exploit requires crafted CBOR input.

  • 8.7 /10 High
    CVE-2026-106447 No auth

    StableLib @stablelib/cbor - Denial of Service

    StableLib @stablelib/cbor < 2.0.4 contains a denial of service caused by lack of maximum nesting depth enforcement in _decodeValue() during recursive CBOR decoding, letting attackers cause process termination via deep nested structures, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-106443

    WeasyPrint - Remote Code Execution

    WeasyPrint < 70.0 contains a remote code execution vulnerability caused by unsafe handling of EPS/PostScript images in the image-loading path, letting remote attackers execute code via crafted PostScript, exploit requires Ghostscript installed with sandbox bypass.

  • 7.8 /10 High
    CVE-2026-106442 No auth

    Hydra - Remote Code Execution

    Hydra 1.3.4 to 1.3.6 and 1.4.0.dev9 contain a remote code execution caused by incomplete target blacklist checks in instantiate() allowing bypass via wrappers and deferred calls, letting attackers execute code with application privileges, exploit requires untrusted configuration instantiation.

  • 7.8 /10 High
    CVE-2026-106441

    Hydra - Remote Code Execution

    Hydra < 1.3.6 and < 1.4.0.dev9 contains a code injection vulnerability caused by unprotected logging configuration passed to logging.config.dictConfig(), letting attackers invoke arbitrary classes with application privileges, exploit requires attacker control over logging configuration.

  • 7.8 /10 High
    CVE-2026-106440

    Hydra - Remote Code Execution

    Hydra 1.2.0 to 1.3.0 and 1.4.0.dev10 with hydra-optuna-sweeper contains a remote code execution caused by unsafe use of hydra.utils.get_method() on configuration-controlled input, letting attackers execute arbitrary Python code with application privileges, exploit requires control over Optuna sweep configuration or command-line overrides.

  • 8.5 /10 High
    CVE-2026-106439

    Hydra - Remote Code Execution

    Hydra 1.3.4 to 1.3.7 and 1.4.0.dev10 contain a code execution vulnerability caused by mutable module-level state allowing attackers controlling multiple sibling target entries to remove denied targets and invoke them, letting attackers execute code with application privileges, exploit requires control over multiple sibling target entries.

  • 8.3 /10 High
    CVE-2026-106426 No auth

    Google Chrome - Race Condition

    Google Chrome < 155.0.8059.39 contains a race condition in Fonts, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.