High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 228 of 568

  • 7.3 /10 High
    CVE-2026-105185 No auth

    itsourcecode Online Admission System - SQL Injection

    itsourcecode Online Admission System 1.0 contains a sql injection caused by manipulation of the "ID" argument in /admin/examinee.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-105184 No auth

    itsourcecode Online Admission System - SQL Injection

    itsourcecode Online Admission System 1.0 contains a SQL injection caused by manipulation of the "ID" argument in /admin/creteria.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-105183 No auth

    itsourcecode Online Admission System - SQL Injection

    itsourcecode Online Admission System 1.0 contains a sql injection caused by manipulation of the argument schedid in /admin/confirm.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105182 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "Title" argument in /reviewer_0/admins/assessments/activities/btn_functions.php?action=update, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105175 No auth

    SourceCodester Drug Recommendation System - SQL Injection

    SourceCodester Drug Recommendation System 1.0 contains a SQL injection caused by manipulation of the "cmdschool" argument in /Auth/add_student.php Student Registration component, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-105172 No auth

    itsourcecode Online Admission System - SQL Injection

    itsourcecode Online Admission System 1.0 contains a sql injection caused by manipulation of the "User" argument in /login1.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-105170 No auth

    kishor-23 food-waste-management-system - Authentication Bypass

    kishor-23 food-waste-management-system contains an authentication bypass caused by manipulation of the "sign" argument in admin/signup.php Admin Signup component, letting remote attackers bypass authentication, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-105169 No auth

    kishor-23 food-waste-management-system - SQL Injection

    kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of "order_id" and "delivery_person_id" arguments in delivery/delivery.php Take Order Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 8.7 /10 High
    CVE-2026-104979 Auth required

    Plane - Stored XSS

    Plane < 1.4.0 contains a stored XSS caused by missing HTML content validation in IntakeIssuePublicViewSet.create, letting authenticated users inject arbitrary HTML that executes JavaScript in viewers' sessions, exploit requires published DeployBoard with intake enabled.

  • 8.2 /10 High
    CVE-2026-104978 Auth required

    Plane - Authentication Bypass

    Plane < 1.4.0 contains an authentication bypass caused by insufficient verification in project invitation endpoints, letting authenticated attackers enumerate and accept invitations by registering invited emails, exploit requires authenticated user access.

  • 7.7 /10 High
    CVE-2026-104977 Auth required

    Plane - Server Side Request Forgery

    Plane < 1.4.0 contains a server-side request forgery caused by incomplete hardening in work-item link unfurling, letting authenticated project members fetch internal targets and read responses, exploit requires authentication.

  • 8.7 /10 High
    CVE-2026-104976 Auth required

    Plane - Server Side Request Forgery

    Plane prior to 1.4.0 contains a server-side request forgery caused by insufficient validation of GITEA_HOST and avatar_url in the Gitea OAuth flow, letting authenticated Gitea users make internal network requests, exploit requires Gitea OAuth enabled and user login.

  • 7.1 /10 High
    CVE-2026-104975 Auth required

    Plane - Broken Access Control

    Plane prior to 1.4.0 contains a broken access control caused by missing membership check and project_id constraint in Spaces app asset endpoints, letting attackers read, overwrite, or restore assets across projects and workspaces, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-104974 Auth required

    Plane - Authentication Bypass

    Plane < 1.4.0 contains an authentication bypass caused by reactivation of deactivated accounts upon login, letting users with deactivated accounts silently reactivate themselves, exploit requires valid user credentials.

  • 7.6 /10 High
    CVE-2026-104973

    Plane - Server Side Request Forgery

    Plane < 1.4.0 contains a server side request forgery caused by improper IP validation in webhook delivery task allowing DNS rebinding to bypass SSRF protection, letting attackers perform SSRF via DNS rebinding, exploit requires DNS rebinding capability.