High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 226 of 568
- 8.7 /10 HighCVE-2026-105632 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains a broken access control caused by insufficient project visibility checks in the GraphQL joinProject mutation, letting any workspace member add themselves to private projects with full Member role, exploit requires workspace membership.
- 7.5 /10 HighCVE-2026-105631 No auth
Plane - Broken Access Control
Plane prior to 1.4.0 contains an information disclosure vulnerability caused by insufficient membership checks in asset retrieval endpoints, letting unauthenticated attackers access private project assets if asset UUID and anchor are known.
- 8.7 /10 HighCVE-2026-105630 Auth required
Plane - Stored XSS
Plane < 1.4.0 contains a stored XSS caused by improper handling of image/svg+xml file uploads with attacker-controlled Content-Type and inline Content-Disposition, letting authenticated low-privilege users execute JavaScript in victim's context, exploit requires victim to open malicious SVG link.
- 7.1 /10 HighCVE-2026-105629 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains a broken access control caused by lack of workspace, project, or estimate scoping in BulkEstimatePointEndpoint.destroy, letting administrators or workspace members delete estimate points across tenants, exploit requires attacker to be an authenticated workspace member or administrator.
- 7.6 /10 HighCVE-2026-105628 Auth required
Plane - Server Side Request Forgery
Plane < 1.4.0 contains a server-side request forgery caused by lack of internal IP validation and default redirect following in OAuth avatar synchronization, letting attackers exfiltrate internal resources by uploading them as user avatars, exploit requires crafted avatar URL.
- 7.3 /10 HighCVE-2026-105470 No auth
girishsaraf Online-Appointment-Booking-System - SQL Injection
girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 contains a sql injection caused by manipulation of "doctorname" argument in mysqli_query function of Doctor Search Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105469 No auth
girishsaraf Online-Appointment-Booking-System - SQL Injection
girishsaraf Online-Appointment-Booking-System contains a SQL injection caused by manipulation of the arguments countryid, townid, cid, didval, or cidval in get_town.php AJAX Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105468 No auth
girishsaraf Online-Appointment-Booking-System - SQL Injection
girishsaraf Online-Appointment-Booking-System contains a SQL injection caused by manipulation of "uname" or "pass" arguments in Admin/mlogin.php Login Handler, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-105392 No auth
Lybbn Django-Vue-Lyadmin - Hardcoded Credentials
Lybbn Django-Vue-Lyadmin <= 3.2.12 contains a hardcoded credentials vulnerability caused by use of a hard-coded SECRET_KEY in JWT Signing, letting remote attackers exploit cryptographic key reuse, exploit requires manual key change before deployment.
- 7.3 /10 HighCVE-2026-105387 No auth
girishsaraf Online-Appointment-Booking-System - SQL Injection
girishsaraf Online-Appointment-Booking-System contains an SQL injection caused by manipulation of "uname" and "psw" arguments in cover.php Patient Login Handler, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-105386 No auth
onetwothreeneth HospitalManagementSystem - SQL Injection
onetwothreeneth HospitalManagementSystem contains a SQL injection caused by manipulation of the "transaction_id" argument in print.php get function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105385 No auth
onetwothreeneth HospitalManagementSystem - SQL Injection
onetwothreeneth HospitalManagementSystem contains a sql injection caused by manipulation of the "transaction_id" argument in transaction_details.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105384 No auth
UNION HospitalManagementSystem - SQL Injection
UNION HospitalManagementSystem contains a SQL injection caused by manipulation of the "patient_id" argument in patient_info.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105383 No auth
onetwothreeneth HospitalManagementSystem - SQL Injection
onetwothreeneth HospitalManagementSystem contains a SQL injection caused by manipulation of the "transaction_idS" argument in php/controller.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105382 No auth
onetwothreeneth HospitalManagementSystem - Broken Access Control
onetwothreeneth HospitalManagementSystem contains a broken access control caused by improper authorization in update_subaccount function of Account Administration, letting remote attackers manipulate user_id to escalate privileges, exploit requires no special privileges.