High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 216 of 568
- 7.5 /10 HighCVE-2026-105852 No auth
Payload - Broken Access Control
Payload before 3.90.0 and canary versions before 4.0.0-canary.34 contain an information disclosure caused by querying readable collections with relationships exposing protected related documents, letting attackers access unauthorized data, exploit requires querying specific collections.
- 8.1 /10 HighCVE-2026-105851 Auth required
Payload - Access Control Bypass
Payload 3.0.0 to < 3.90.0 and canary < 4.0.0-canary.34 contains an access control bypass caused by duplicate operation copying values despite hidden fields or access rules, letting attackers bypass access restrictions, exploit requires crafted duplicate operation.
- 8.2 /10 HighCVE-2026-105850
Payload @payloadcms/plugin-ecommerce - Broken Authentication
Payload @payloadcms/plugin-ecommerce < 3.90.0 and canary < 4.0.0-canary.34 contains a logic flaw in Stripe payment adapter allowing multiple processing of Stripe order confirmations, letting attackers cause duplicate order processing, exploit requires specific payment conditions.
- 8.3 /10 HighCVE-2026-105849 Auth required
Payload - Broken Access Control
Payload 3.0.0 < 3.90.0 and canary < 4.0.0-canary.34 contain an information disclosure vulnerability caused by improper access control in authentication documents with useAPIKey enabled, letting users with read access obtain active API keys, exploit requires read access to authentication documents.
- 7.5 /10 HighCVE-2026-105841 No auth
lrzsz - Command Injection
lrzsz before 0.13.0 contains a command injection vulnerability caused by unescaped filenames passed to popen() in the lrz receive utility's pipe mode, letting remote senders execute OS commands, exploit requires crafted filenames.
- 7.5 /10 HighCVE-2026-105840 No auth
lrzsz - Path Traversal
lrzsz before 0.13.0 contains a path traversal vulnerability caused by insufficient path validation in the lrz receive utility's restricted mode, letting malicious ZMODEM senders write files outside the current directory using absolute pathnames, exploit requires attacker to send crafted files.
- 7.8 /10 HighCVE-2026-105839 No auth
libmikmod - Integer Overflow
libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() caused by crafted track counts in SLEN chunk, letting attackers cause heap buffer overflow for crashes or code execution, exploit requires crafted OKT module.
- 7.8 /10 HighCVE-2026-105837 No auth
libmikmod - Integer Overflow
libmikmod before 3.3.14 contains an integer overflow vulnerability caused by product wrap of numchn and numpat in DSM_Load() in load_dsm.c, letting attackers trigger heap buffer overflow and potential code execution, exploit requires crafted DSM module.
- 7.4 /10 HighCVE-2026-105835 No auth
Planka - Authentication Bypass
Planka 2.2.0 through 2.2.1 contains a broken authentication caused by failure to limit incorrect TOTP codes on POST /api/access-tokens/verify-totp, letting attackers brute force two-factor authentication codes, exploit requires attacker to know user password and reuse pending token.
- 7.3 /10 HighCVE-2026-105807 No auth
SourceCodester Simple Student Information System - SQL Injection
SourceCodester Simple Student Information System 1.0 contains a sql injection caused by manipulation in searchquery.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 8.6 /10 HighCVE-2026-105806 Auth required
Payload @payloadcms/plugin-mcp - Broken Access Control
Payload @payloadcms/plugin-mcp 3.61.0 to 3.88.0 contains a broken access control vulnerability caused by improper management of MCP API keys, letting authenticated users escalate privileges via account takeover, exploit requires authentication.
- 8.4 /10 HighCVE-2026-105801 No auth
openapi-python-client - Code Injection
openapi-python-client < 0.29.1 contains a code injection caused by unsafe neutralization of malicious OpenAPI document content in string, docstring, and f-string contexts, letting attackers execute arbitrary Python code on import, exploit requires importing the generated client.
- 8.7 /10 HighCVE-2026-105798 Auth required
SimpleChat - Stored XSS
SimpleChat < 0.261.029 contains a stored XSS caused by improper escaping of attacker-controlled group document filenames in group_workspaces.html, letting authenticated group Owner, Admin, or DocumentManager execute scripts in victim sessions when Share is clicked.
- 8.8 /10 HighCVE-2026-105797 Auth required
SimpleChat - Command Injection
SimpleChat 0.261.003 and 0.261.027 contain a command injection caused by an authorization ordering flaw in POST /api/user/plugins, letting authenticated low-privileged users execute OS processes under the service identity, exploit requires personal plugins enabled and governance permitting MCP actions.
- 8.8 /10 HighCVE-2026-105796 No auth
Kiota - Code Injection
Kiota 0.5.0 to 1.35.0 contains a code injection vulnerability caused by improper sanitization of documentation comments in Java and PHP generators, letting attackers inject code executed in build or application context, exploit requires generating and compiling/loading malicious source code.