High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 21 of 552
- 7.0 /10 HighCVE-2026-53612 Auth required
util-linux - Privilege Escalation
util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1 contain a privilege escalation caused by a race condition in the SUID mount utility's hook_owner.c post-mount hook performing path-based chmod() and lchown() operations, letting local low-privileged users with specific /etc/fstab authorization gain root privileges, exploit requires user or users fstab entry with X-mount options.
- 8.5 /10 HighCVE-2026-50218 Auth required
Akamai GPA - Authentication Bypass
Akamai GPA (Guardicore Platform Agent) client < 7.4 contains a broken authentication caused by improper validation of JWT tokens used for seeding, letting attackers inject arbitrary parameters and fully compromise the client, exploit requires user interaction with a malicious link or knowledge of the IDP URL.
- 8.7 /10 HighCVE-2026-42093 Auth required
Redash - SQL Injection
Redash > 8.0.0 and < 26.9.0 contains a SQL injection caused by unsafe substitution of param_query_N_{key=value} parameters in Query Results query runner, letting authenticated users with view access inject SQL with referenced data source privileges, exploit requires authenticated user with view access to both data sources.
- 8.8 /10 HighCVE-2026-33798 No auth
Juniper Networks Junos OS - Buffer Overflow
Juniper Networks Junos OS and Junos OS Evolved on SRX Series contain a stack-based buffer overflow caused by improper handling in srxpfe, letting L2-adjacent attackers execute arbitrary code as root via high-availability fabric traffic, exploit requires L2 adjacency.
- 7.5 /10 HighCVE-2026-33795 No auth
Juniper Networks Junos OS & Junos OS Evolved - Denial of Service
Juniper Networks Junos OS and Junos OS Evolved >= 20.4R1 contain a denial of service caused by a numeric truncation error in the rpd process triggered by BGP Prefix-SID route advertisement, letting unauthenticated network attackers cause service disruption, exploit requires network access to send BGP advertisements.
- 7.1 /10 HighCVE-2026-19673 No auth
Zephyr OS - Out of Bounds Read/Write
Zephyr OS with CONFIG_NET_VLAN=y and VLAN enabled on Ethernet interfaces without hardware VLAN tag stripping contains a buffer length validation flaw in ethernet_recv() caused by improper length checks on VLAN tagged frames, letting remote attackers cause denial of service and out-of-bounds memory access, exploit requires crafted short VLAN tagged Ethernet frames.
- 8.1 /10 HighCVE-2026-17092 Auth required
Directorist AI-Powered Business Directory - Authorization Bypass
Directorist AI-Powered Business Directory plugin for WordPress <= 8.10.2.1 contains an authorization bypass caused by improper user authorization verification, letting authenticated subscribers delete arbitrary listings, exploit requires subscriber-level access.
- 8.1 /10 HighCVE-2026-15176 No auth
NGINX - Buffer Overflow
NGINX Plus and NGINX Open Source contain a heap buffer overflow caused by use of alias directive with rewrite and set or return referencing $request_filename, letting unauthenticated attackers cause DoS or code execution, exploit requires crafted HTTP requests.
- 7.5 /10 HighCVE-2026-15102 Auth required
ADP Desktop SDK - Information Disclosure
ADP Desktop SDK contains a clear text transmission vulnerability causing sensitive information exposure, letting attackers gain unauthorized access to Autodesk services, exploit requires network access.
- 7.7 /10 HighCVE-2026-14765 No auth
Epic Games Unreal Engine - Command Injection
Epic Games Unreal Engine <= 5.8.0 contains a command injection caused by insecure default configuration of LaunchURL Blueprint node allowing execution of files via file:/// URI, letting attackers execute arbitrary commands, exploit requires loading user-generated content with malicious Blueprints.
- 7.1 /10 HighCVE-2026-110873 Auth required
Heym - Privilege Escalation
Heym 0.0.55 before 0.0.121 contains a privilege escalation caused by missing error_workflow_id from OWNER_ONLY_EXECUTION_FIELDS, letting shared collaborators overwrite error workflows and exfiltrate owner's decrypted credentials, exploit requires collaborator access.
- 7.5 /10 HighCVE-2026-110869 No auth
Nodemailer - Denial of Service
Nodemailer < 10.0.13 contains a regular expression denial of service caused by overlapping whitespace sub-patterns in SMTPConnection._actionEHLO AUTH mechanism detection regexes, letting a malicious or man-in-the-middle SMTP server block the Node.js event loop, exploit requires interaction with a malicious SMTP server.
- 8.5 /10 HighCVE-2026-110868 Auth required
Renovate - Server-Side Request Forgery
Renovate < 44.79.0 contains a server-side request forgery caused by allowing users to make shared HTTP client requests to arbitrary internal URLs via extends presets or customDatasources, letting attackers obtain AWS credentials or leak sensitive information through logs, exploit requires crafted presets or customDatasources.
- 8.5 /10 HighCVE-2026-110867 Auth required
Renovate - Allowlist Bypass
Renovate < 44.60.1 contains an allowlist bypass vulnerability caused by improper environment variable filtering in shared presets, letting attackers controlling external presets override restricted environment variables, exploit requires attacker control of external preset.
- 7.1 /10 HighCVE-2026-110865 Auth required
Renovate - Allowlist Bypass
Renovate < 44.60.1 contains an allowlist bypass vulnerability caused by unvalidated hostRules headers in shared presets, letting repository users inject custom HTTP headers, exploit requires repository access.