High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 22 of 725
- 7.1 /10 HighCVE-2026-119707 Auth required
SonicJS - Broken Access Control
SonicJS <= 3.0.0 contains a broken access control caused by insufficient authorization checks on /api/:collection and /api/content write routes, letting authenticated authors or editors bypass ACLs to modify others' documents, exploit requires authentication with author or editor role.
- 7.9 /10 HighCVE-2026-119682 No auth
ManageEngine SharePoint Manager Plus - Broken Access Control
ManageEngine SharePoint Manager Plus < 4507 contains an improper access control vulnerability in MFA functionality, letting low-privileged authenticated users read/modify MFA settings and delete enrolled accounts, exploit requires low-privileged authentication.
- 8.5 /10 HighCVE-2026-119680 Auth required
SharePoint Manager Plus - Stored XSS
SharePoint Manager Plus contains a stored XSS caused by improper sanitization and HTML encoding of user-controlled data in chart attributes, letting attackers inject malicious scripts executed in other users' browsers, exploit requires user interaction.
- 8.8 /10 HighCVE-2026-119662 No auth
Songloft - Hardcoded Credentials
Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability caused by fixed admin/admin credentials in /api/v1/auth/login, letting adjacent network attackers authenticate as administrator and modify settings, exploit requires network adjacency.
- 7.5 /10 HighCVE-2026-119656 No auth
CoreShop by CoreUnion - SQL Injection
CoreShop by CoreUnion through 1.5.5 contains an sql injection caused by improper sanitization of the order parameter in api/Agent/GetGoodsPageList endpoint, letting anonymous attackers extract member accounts and orders via blind techniques.
- 7.5 /10 HighCVE-2026-119655 No auth
CoreShop - SQL Injection
CoreShop <= 1.5.5 contains an unauthenticated SQL injection caused by unvalidated 'order' parameter in api/Good/GetGoodsPageList endpoint, letting attackers extract member accounts and orders via blind SQL techniques, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-119654 Auth required
DataCap - Broken Access Control
DataCap through 2025.1.1 contains a broken access control vulnerability caused by missing authorization checks in administrative role and menu management APIs, letting authenticated users escalate privileges by assigning themselves administrator roles.
- 7.1 /10 HighCVE-2026-119649 Auth required
Orchard CMS - Broken Access Control
Orchard CMS 1.10.3 through 1.11 contains a broken access control vulnerability caused by improper authorization in MediaLibraryService.CheckMediaFolderPermission(), letting authenticated Authors and Contributors access and manipulate other users' media, exploit requires authenticated author or contributor role.
- 7.3 /10 HighCVE-2026-119620 No auth
cak-filemanagement-system - Unrestricted File Upload
cak-filemanagement-system <= 5e6433246475e66462e1fea980688de96a049297 contains an unrestricted file upload caused by manipulation of the File argument in admin/add_logs.php, letting remote attackers upload arbitrary files, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-119619 No auth
cak-filemanagement-system - SQL Injection
cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297 contains an SQL injection caused by manipulation of arguments date, department, subject, forwarded_to, action_taken_by, section, and password in admin/save_student.php mysqli_query, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.8 /10 HighCVE-2026-119586 No auth
SQLite - Command Injection
SQLite command-line shell through 3.54.1 contains a command injection caused by attacker-planted dot-commands in sqlite_schema.sql values in the .recover command, letting attackers execute OS commands when .recover output is piped into sqlite3, exploit requires victim to pipe .recover output.
- 7.8 /10 HighCVE-2026-119578 No auth
MONAI - Remote Code Execution
MONAI 1.6.0 before 1.6.1 contains a remote code execution caused by unsafe deserialization in Auto3DSeg algo_from_json(), letting attackers execute arbitrary Python code via crafted algo_object.json, exploit requires victim to call AutoRunner or import_bundle_algo_history.
- 8.7 /10 HighCVE-2026-119572 No auth
Traefik - Authentication Bypass
Traefik 3.7.0-ea.1 before 3.7.15 contains an authentication bypass caused by silent disabling of mTLS via auth-tls-secret annotation in Kubernetes Ingress NGINX provider, letting unauthenticated attackers access backends requiring client certificates.
- 7.4 /10 HighCVE-2026-119568
vsftpd - Authentication Bypass
vsftpd through 3.0.5 contains an authentication bypass caused by TLS session ticket resumption in ssl_data_accept(), letting unauthenticated attackers sharing victim's source IP hijack FTPS data connections, exploit requires attacker to share victim's source IP.
- 7.1 /10 HighCVE-2026-119549 Auth required
Jellyfin - Server Side Request Forgery
Jellyfin <= 12.4 contains a server-side request forgery caused by bypassing SvgSecurityValidator via gzip-compressed SVG in non-SVG image data URIs, letting authenticated users fetch internal URLs or exhaust memory, exploit requires user authentication.