High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 227 of 568
- 7.5 /10 HighCVE-2026-105314 PoC publicAuth required
Papermerge - Remote Code Execution
Papermerge 3.5.3 contains a remote code execution caused by directory traversal in /api/documents/upload, letting standard users write Python .pth files to site-packages and execute code on interpreter restart, exploit requires standard user privileges.
- 7.3 /10 HighCVE-2026-105307 No auth
Casdoor - Authentication Bypass
Casdoor <= 3.161.1 contains an authentication bypass caused by manipulation in ApiFilter function in routers/authz_filter.go API Endpoint, letting remote attackers bypass authentication, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-105295
GitAhead - Remote Code Execution
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism caused by lack of integrity and signature verification and ignoring TLS errors, letting network attackers execute code as the user via fake updates, exploit requires attacker to intercept update checks.
- 7.4 /10 HighCVE-2026-105294 No auth
Legcord - Configuration Injection
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability caused by improper validation in window.legcord settings.setConfig bridge, letting attackers exploiting Discord XSS persistently modify client config, exploit requires Discord XSS.
- 8.1 /10 HighCVE-2026-105293 No auth
Legcord - Path Traversal
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability caused by unvalidated theme IDs in theme IPC handlers, letting attackers running script in Discord origin execute local files and modify directories, exploit requires script execution in Discord origin.
- 7.3 /10 HighCVE-2026-105290 No auth
feelec-yishu feelcrm-os - Server-Side Request Forgery
feelec-yishu feelcrm-os 1.0.0 contains a server-side request forgery caused by manipulation of the "url" argument in getCurlData Endpoint of GoogleController.class.php, letting remote attackers make arbitrary requests, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105253 No auth
itsourcecode Online Admission System Project - SQL Injection
itsourcecode Online Admission System Project 1.0 contains a sql injection caused by manipulation of the "User" argument in /admin/login1.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105247 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "Subject" argument in /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105246 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "Subject" argument in /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105238 No auth
ChatGPTNextWeb NextChat - Server-Side Request Forgery
ChatGPTNextWeb NextChat <= 2.16.1 contains a server-side request forgery caused by manipulation of the "x-base-url" argument in app/api/proxy.ts Proxy Fallback Handler, letting remote attackers initiate SSRF, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105232 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of username/email/location arguments in delivery/deliverysignup.php Registration Page, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-105231 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of email, username, or location arguments in admin/signup.php Admin Registration component, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105230 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of "delivery_person_id" or "order_id" arguments in delivery/deliverymyord.php, letting remote attackers execute arbitrary SQL queries, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105229 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of email, name, or gender arguments in signup.php User Registration Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.4 /10 HighCVE-2026-105223 No auth
maclof kubernetes-client - Authentication Bypass
maclof kubernetes-client < 0.32.0 contains a broken authentication caused by disabled TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when kubeconfig lacks certificate-authority-data, letting on-path attackers capture credentials and tamper API traffic, exploit requires a kubeconfig without certificate-authority-data.