High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 22 of 552
- 7.4 /10 HighCVE-2026-110864 No auth
Better Auth - Authentication Bypass
Better Auth 1.5.0-beta.12 before 1.7.7 contains an authentication bypass caused by forging encrypted profiles in the OAuth Proxy plugin, letting unauthenticated attackers sign in as other users, exploit requires shared global secret and cookie-stored state.
- 8.1 /10 HighCVE-2026-110863 Auth required
Better Auth - Authentication Bypass
Better Auth @better-auth/sso >= 1.7.0-rc.2 < 1.7.3 contains an authentication bypass caused by ignoring providerId in account lookup when registering personal SSO providers, letting authenticated users sign in as other users.
- 7.5 /10 HighCVE-2026-110859 No auth
GitPython - Command Injection
GitPython < 3.2.0 contains an argument injection vulnerability in Head.checkout() caused by parsing branch names as git options, letting remote attackers read arbitrary files, exploit requires cloning a repository with a crafted default branch.
- 8.1 /10 HighCVE-2026-110858 No auth
GitPython - Remote Code Execution
GitPython > 3.1.30 < 3.2.0 contains a remote code execution caused by unsafe handling of positional refspec in Remote.pull(), letting attackers execute OS commands via --upload-pack, exploit requires attacker control of refspec.
- 7.5 /10 HighCVE-2026-110857 No auth
GitPython - Remote Code Execution
GitPython < 3.2.0 contains a remote code execution caused by unvalidated forwarding of URLs in Git.ls_remote and unguarded option injection in merge_base and IndexFile.move, letting attackers execute arbitrary commands remotely, exploit requires git ext transport enabled.
- 7.5 /10 HighCVE-2026-110856 No auth
GitPython - Denial of Service
GitPython < 3.2.0 contains a regular expression denial of service caused by the _re_actor_epoch pattern in parse_actor_and_date on author, committer, and tagger lines, letting attackers cause CPU exhaustion via crafted repository data, exploit requires attacker to serve malicious repository data.
- 8.2 /10 HighCVE-2026-110854 No auth
Parse Server - Denial of Service
Parse Server < 8.6.97 and 9.0.0 < 9.10.2-alpha.6 contains a denial of service caused by unhandled errors during email verification or password reset sending, letting clients with public application keys crash the server, exploit requires client access with public keys.
- 7.1 /10 HighCVE-2026-110853 Auth required
n8n - Authorization Bypass
n8n < 1.123.83 contains an authorization bypass caused by trusted identifier spoofing in Execute Sub-workflow inline JSON mode, letting authenticated members access and modify workflows they do not belong to, exploit requires authentication.
- 7.2 /10 HighCVE-2026-110850 Auth required
n8n - Broken Access Control
n8n < 2.41.4 and 2.42.0 < 2.42.1 contain an information disclosure caused by improper validation of credential IDs in agent node parameters, letting editors access and exfiltrate owner's decrypted secrets, exploit requires editor privileges.
- 7.2 /10 HighCVE-2026-110849 Auth required
n8n - Stored XSS
n8n < 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting caused by re-publishing binary data as an unsandboxed same-origin blob URL in the file-preview modal, letting authenticated members execute scripts in the session of previewers, exploit requires attacker to upload crafted item.
- 7.0 /10 HighCVE-2026-110847 Auth required
n8n - Stored XSS
n8n < 1.123.83, 2.x < 2.41.4, and 2.42.x < 2.42.1 contain a stored cross-site scripting caused by insufficient sanitization of customCss values in the Chat Trigger hosted-chat page, letting workflow authors publish malicious chat payloads executing on signed-in visitors' sessions, exploit requires published chat without user authentication.
- 7.0 /10 HighCVE-2026-110846 No auth
n8n - Authentication Bypass
n8n < 2.41.4 and 2.42.x < 2.42.1 contains a signature bypass caused by improper validation in the waiting-webhook endpoint, letting attackers with execution resume tokens approve others' executions and run actions as workflow owners.
- 7.7 /10 HighCVE-2026-110845 Auth required
n8n - Remote Code Execution
n8n < 1.123.83, 2.x < 2.41.4, and 2.42.x < 2.42.1 contain a remote code execution caused by failure to strip local git configuration in the Git node Log operation, letting authenticated users execute programs as the n8n process user, exploit requires authenticated access.
- 7.2 /10 HighCVE-2026-110844 Auth required
n8n - Authorization Bypass
n8n < 1.123.83 contains an authorization bypass caused by shared-workflow editors embedding restricted credentials in nested or inline sub-workflows, letting attackers execute workflows with unauthorized credential values, exploit requires shared-workflow editor privileges.
- 8.2 /10 HighCVE-2026-110843 No auth
n8n - Denial of Service
n8n < 2.41.4 and 2.42.x < 2.42.1 contains an uncontrolled resource consumption vulnerability caused by storing caller's raw identifier as record key in the unauthenticated OAuth authorize endpoint, letting unauthenticated attackers exhaust disk space by creating unlimited client records, exploit requires no authentication.