High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 215 of 568
- 8.2 /10 HighCVE-2026-106038 No auth
Mooncake Store - Authentication Bypass
Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability caused by lack of authentication on coro_rpc port methods, letting unauthenticated attackers force-delete any object, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-105985 Auth required
Craft CMS - Remote Code Execution
Craft CMS 5.10.13.2 contains an authenticated remote code execution caused by unsandboxed Twig template evaluation in Control Panel action app/render-components, letting authenticated users execute OS commands with web server privileges, exploit requires basic Control Panel access.
- 7.3 /10 HighCVE-2026-105920 No auth
Kusalkasilva Learning-Management-System - SQL Injection
Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 contains a SQL injection caused by manipulation in student_signup.php Student Registration Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105919 No auth
Kusalkasilva Learning-Management-System - SQL Injection
Kusalkasilva Learning-Management-System contains a SQL injection caused by manipulation of username/password arguments in admin/login.php Administrator Login Endpoint, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-105918 No auth
Kusalkasilva Learning-Management-System - SQL Injection
Kusalkasilva Learning-Management-System contains a SQL injection caused by manipulation of username/password arguments in login.php login endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-105868 No auth
Payload - Stored XSS
Payload < 3.90.0 and canary < 4.0.0-canary.34 contain a stored XSS caused by local upload configurations accepting XML files with stylesheets, letting logged-in users execute JavaScript in the Payload origin, exploit requires user to be logged in.
- 7.5 /10 HighCVE-2026-105866 No auth
Payload - Authentication Bypass
Payload before 3.90.0 and canary versions before 4.0.0-canary.34 contain an account lockout abuse vulnerability caused by improper handling of local-authentication collections, letting unauthenticated attackers prevent account sign-in by triggering lockout, exploit requires knowledge of account email or username.
- 8.1 /10 HighCVE-2026-105865 Auth required
Payload - Broken Access Control
Payload before 3.90.0 and canary before 4.0.0-canary.34 contains a file cleanup vulnerability caused by improper restriction on file deletion outside the upload directory, letting authenticated users cause data loss or service disruption, exploit requires upload update or delete permissions.
- 8.7 /10 HighCVE-2026-105862 Auth required
Payload - Stored XSS
Payload before 3.90.0 and canary versions before 4.0.0-canary.34 contain a stored XSS caused by insufficient sanitization of downloadable SVG uploads in collections, letting attackers execute JavaScript when users open the SVG, exploit requires user to download and open the SVG.
- 8.2 /10 HighCVE-2026-105861 No auth
Payload - Open Redirect
Payload >3.0.0 and <3.90.0 contains an open redirect caused by unverified external URL-based upload retrieval forwarding authentication data, letting authenticated attackers expose valid sessions to unintended recipients, exploit requires authentication.
- 7.1 /10 HighCVE-2026-105860 Auth required
Payload @payloadcms/plugin-multi-tenant - Broken Access Control
Payload @payloadcms/plugin-multi-tenant < 3.90.0 and < 4.0.0-canary.34 contains a broken access control caused by default tenant array field access allowing authenticated users to assign their account to other tenants, letting authenticated users escalate privileges, exploit requires authentication.
- 8.1 /10 HighCVE-2026-105858
Payload - Remote Code Execution
Payload < 3.90.0 and canary < 4.0.0-canary.34 contains a remote code execution caused by crafted requests to the public first-register operation when local authentication is enabled and no initial user exists, letting attackers execute code remotely.
- 8.3 /10 HighCVE-2026-105856 Auth required
Payload - SQL Injection
Payload before 3.90.0 and 4.0.0-canary.34 contains a SQL injection caused by crafted field path and operators in JSON or blocks fields with blocksAsJSON enabled, letting attackers with read and create or update access inject SQL.
- 7.1 /10 HighCVE-2026-105855 Auth required
Payload - Broken Access Control
Payload < 3.90.0 and canary < 4.0.0-canary.34 contain a broken access control caused by failure to enforce field-level update restrictions on the password field in the authentication collection, letting attackers modify passwords without proper authorization.
- 7.5 /10 HighCVE-2026-105854 No auth
Payload - Denial of Service
Payload 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 contain a denial of service caused by malformed multipart request body processing, letting attackers cause uncontrolled resource consumption, exploit requires sending crafted multipart requests.