High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 221 of 568

  • 7.2 /10 High
    CVE-2026-101154 Auth required

    Platform - Broken Access Control

    The platform contains a file read and write vulnerability caused by specially crafted requests or file uploads to the Network Provisioning Image Repository, letting authenticated remote attackers with specific permissions access or modify files beyond intended scope.

  • 8.0 /10 High
    CVE-2026-101153 Auth required

    CloudVision Portal & Sensor - Path Traversal

    CloudVision Portal (on-premises) and CloudVision Sensor contain a path traversal caused by insufficient validation, letting authenticated users with high privileges extract unintended data from the Sensor.

  • 8.0 /10 High
    CVE-2026-101152 No auth

    CloudVision - Authentication Bypass

    CloudVision contains a broken authentication caused by insufficient validation in the Single Sign-On (SSO) login flow, letting remote unauthenticated attackers redirect authentication material to attacker-controlled URLs, exploit requires user interaction.

  • 7.7 /10 High
    CVE-2026-101027 Auth required

    Gitea - Server Side Request Forgery

    Gitea contains a server-side request forgery caused by insufficient validation of resolved addresses for allowed hostnames in migrations, letting attackers bypass local network restrictions and access internal services, exploit requires control over DNS of allowed hostname.

  • 8.1 /10 High
    CVE-2025-45871 Auth required

    LogicalDOC Enterprise - SQL Injection

    LogicalDOC Enterprise <= 9.1.1 contains a blind SQL injection caused by manipulation of workflow template name in WorkflowsDataServlet, letting authenticated users manipulate SQL queries.

  • 7.1 /10 High
    CVE-2026-97309 Auth required

    Webful Creations RepairBuddy - Broken Access Control

    Webful Creations RepairBuddy <= 4.1226 contains a broken access control vulnerability caused by missing authorization checks, letting attackers retrieve embedded sensitive data, exploit requires no special privileges.

  • 7.6 /10 High
    CVE-2026-97303 Auth required

    Apps Mav Scratch & Win – Giveaways and Contests - Broken Access Control

    Apps Mav Scratch & Win – Giveaways and Contests <= 3.0.2 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-97257 Auth required

    PressTigers Simple Event Planner - Insecure Deserialization

    PressTigers Simple Event Planner <= 1.5.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-95265 No auth

    Feehi CMS - Server Side Request Forgery

    Feehi CMS 2.1.1 contains a server side request forgery caused by insufficient private-IP validation in the UEditor catchimage endpoint, letting attackers probe internal HTTP services, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-95263 Auth required

    Feehi CMS - Broken Access Control

    Feehi CMS 2.1.1 contains an incorrect access control vulnerability caused by lack of protection on the built-in super administrator account, letting low-privilege backend administrators change its password without the old password.

  • 8.2 /10 High
    CVE-2026-94201 No auth

    Ash - Denial of Service

    Ash 3.5.1 to < 3.34.3 contains a denial of service caused by unsafe atom interning in :atom-typed attributes with unsafe_to_atom?: true, letting attackers exhaust the atom table and crash the node, exploit requires attacker-controlled filter values.

  • 7.2 /10 High
    CVE-2026-93617 Auth required

    Sunshine Photo Cart - Insecure Deserialization

    Sunshine Photo Cart <= 3.7.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-93318

    BuildKit - Code Injection

    BuildKit contains a code injection vulnerability caused by trusting advertised DiffIDs without validating actual layer contents, letting attackers run malicious code in victim builds, exploit requires shared or persistent cache usage.

  • 7.1 /10 High
    CVE-2026-93316

    BuildKit - Denial of Service

    BuildKit daemon contains a denial of service caused by panic when builds use CDI devices while started with --cdi-disabled, letting attackers or accidental triggers crash the daemon, exploit requires daemon started with --cdi-disabled.

  • 8.8 /10 High
    CVE-2026-92931 No auth

    Progress @progress/sitefinity-nextjs-sdk - Server-Side Request Forgery

    Progress @progress/sitefinity-nextjs-sdk 15.1.8326 through 15.4.8637 contains a server-side request forgery caused by improper validation of URLs, letting remote attackers make server-side requests to attacker-controlled hosts, exploit requires network access.