High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 225 of 568

  • 7.1 /10 High
    CVE-2026-105761 Auth required

    Dify - Broken Access Control

    Dify < 1.16.0 contains a broken access control vulnerability caused by lack of ownership verification in AppMCPServerController.put() for MCP server updates, letting authenticated workspace members modify other applications' MCP servers, exploit requires authentication as workspace member.

  • 7.5 /10 High
    CVE-2026-105744 PoC publicNo auth

    Docling - Command Injection

    Docling 2.94.0 to 2.132.0 contains a file read and write vulnerability caused by unrestricted TeX primitives in the Tectonic LaTeX engine, letting attackers read and overwrite files or execute shell commands, exploit requires enabling tikz_engine="tectonic" option.

  • 7.1 /10 High
    CVE-2026-105741 Auth required

    Langflow - Misconfiguration

    Langflow 1.5.0 to 1.10.3 contains an IP spoofing vulnerability caused by improper validation of X-Forwarded-For header in MCP configuration installation endpoint, letting authenticated attackers bypass local-only restriction and overwrite configuration files.

  • 7.1 /10 High
    CVE-2026-105699 Auth required

    Langflow - Broken Access Control

    Langflow 1.6.8 to 1.9.1 contains a broken access control vulnerability caused by lack of authorization checks on resource URIs in project-scoped MCP connections, letting authenticated users access other users' private flow files, exploit requires authenticated access to any project-scoped MCP endpoint.

  • 7.3 /10 High
    CVE-2026-105679 Auth required

    Ghost - Stored XSS

    Ghost 6.22.1 to 6.64.0 contains a stored XSS caused by improper content type restriction on uploaded files in the default local storage adapter, letting staff users host scripts that may compromise other admin sessions, exploit requires staff user privileges.

  • 7.2 /10 High
    CVE-2026-105677 Auth required

    Ghost - Remote Code Execution

    Ghost 6.10.3 to 6.64.0 contains a remote code execution caused by improper loading of theme translation files, letting authenticated administrators execute arbitrary code on the server via crafted themes.

  • 7.5 /10 High
    CVE-2026-105675 Auth required

    Ghost - Broken Access Control

    Ghost 4.39.0 to 6.64.0 contains a broken access control caused by staff users with view staff invites permission discovering secret tokens of pending invites, letting staff users escalate privileges by accepting invites, exploit requires staff user permission.

  • 7.3 /10 High
    CVE-2026-105651 Auth required

    Ghost - Stored XSS

    Ghost 5.94.0 to 6.64.0 contains a stored XSS caused by storing non-image files as bookmark icons or thumbnails, letting any staff user host arbitrary HTML on the site's domain, exploit requires staff user privileges.

  • 8.1 /10 High
    CVE-2026-105650 No auth

    Ghost - Stored XSS

    Ghost 2.1.0 to 6.64.0 contains a stored XSS caused by embedding URLs from attacker-controlled websites in post content, letting attackers execute scripts in editor, site, and emails, exploit requires crafted post content.

  • 7.3 /10 High
    CVE-2026-105649 Auth required

    Ghost - Stored XSS

    Ghost 4.22.0 to 6.65.0 contains a stored XSS caused by unsanitized SVG media thumbnails and SVG images uploaded with non-SVG extensions, letting staff users host scripts on the site domain, exploit requires staff user privileges.

  • 7.3 /10 High
    CVE-2026-105643 Auth required

    Ghost - Stored XSS

    Ghost 6.34.0 to 6.67.0 contains a stored cross-site scripting caused by insufficient sanitization of embed cards in the editor, letting any staff user execute scripts in other staff users' admin sessions, exploit requires staff user privileges.

  • 8.8 /10 High
    CVE-2026-105642 No auth

    Ghost - Command Injection

    Ghost 6.56.0 to 6.67.0 contains a command injection caused by vulnerable SVG handling in an image processing library, letting any staff user execute arbitrary commands on the server, exploit requires staff user privileges.

  • 7.4 /10 High
    CVE-2026-105635

    Plane - Broken Access Control

    Plane < 1.4.0 contains a broken access control caused by ProjectJoinEndpoint allowing unauthenticated access to full ProjectMemberInvite records and insufficient validation on POST, letting attackers accept invitations without original invite, exploit requires knowing invitation UUID.

  • 8.1 /10 High
    CVE-2026-105634 Auth required

    Plane - Broken Access Control

    Plane < 1.3.0 contains a broken access control vulnerability caused by insufficient authorization checks in ProjectMemberViewSet.partial_update, letting project members with GUEST role demote other members, exploit requires being a project member.

  • 7.1 /10 High
    CVE-2026-105633 Auth required

    Plane - Broken Access Control

    Plane prior to 1.4.0 contains a broken access control caused by improper validation of issue_id in the V2 issue-attachment PATCH endpoint, letting project members modify attachments they do not own, exploit requires project membership.