High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 229 of 568
- 8.5 /10 HighCVE-2026-104971 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains broken access control caused by missing workspace authorization checks in DuplicateAssetEndpoint, WorkspaceFileAssetEndpoint, FileAssetEndpoint, and WorkspaceViewViewSet.retrieve, letting authenticated users access and modify assets across workspaces without membership, exploit requires authentication.
- 8.1 /10 HighCVE-2026-104970 No auth
Plane - Broken Access Control
Plane 0.13 to 1.4.0 contains a broken access control caused by lack of atomic transaction and locking in InstanceAdminSignUpEndpoint, letting unauthenticated attackers create multiple instance-admin accounts concurrently.
- 8.7 /10 HighCVE-2026-104968 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains an information disclosure vulnerability caused by lack of workspace-membership checks in GET /api/workspaces/{slug}/entity-search/, letting authenticated users access workspace member details without membership, exploit requires authentication and knowledge of workspace slug.
- 8.7 /10 HighCVE-2026-104966 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains a broken access control caused by improper verification of nested resource identifiers in workspace and project endpoints, letting authenticated users read or modify estimates and inject comments across workspaces, exploit requires authentication.
- 8.1 /10 HighCVE-2026-104905 PoC publicAuth required
FacturaScripts - Insecure Deserialization
FacturaScripts before version 2026.7 contains a PHP object injection caused by unsafe unserialize() usage in WidgetSelect::processFormData(), letting authenticated attackers delete arbitrary files via serialized XLSXWriter objects, exploit requires authentication.
- 8.7 /10 HighCVE-2026-104892 Auth required
Plane - Authentication Bypass
Plane < 1.4.0 contains a broken authentication vulnerability caused by aPITokenLogMiddleware logging API keys in plaintext, letting low-privilege attackers steal API keys and escalate privileges, exploit requires low privilege access.
- 7.5 /10 HighCVE-2026-104891 No auth
@insumermodel mppx-condition-gate - Authentication Bypass
@insumermodel mppx-condition-gate < 3.0.0 and mppx-token-gate < 1.0.4 contain an authentication bypass caused by accepting client-supplied wallet addresses without verifying control, letting unauthenticated attackers gain unauthorized free access, exploit requires attacker to specify a qualifying wallet address.
- 7.2 /10 HighCVE-2026-104890 Auth required
Kunstmaan CMS - Remote Code Execution
Kunstmaan CMS < 7.3.2 contains a remote code execution vulnerability caused by case-sensitive blacklisted extension checks in FileHandler, letting authenticated backend users upload executable files bypassing restrictions.
- 8.2 /10 HighCVE-2026-104852 No auth
GraphQL Tools - Prototype Pollution
GraphQL Tools utils package < 12.0.1 contains a prototype pollution caused by mergeDeep function merging inherited properties including __proto__, constructor, and prototype keys, letting unauthenticated GraphQL clients cause denial of service by breaking subsequent requests, exploit requires unauthenticated client to alias fields.
- 8.4 /10 HighCVE-2026-104811 Auth required
DigitalCanion SA - Remote Code Execution
DigitalCanion SA product contains a remote code execution vulnerability caused by improper validation of uploaded file types in Configuration → Services → Music on Hold, letting authenticated attackers execute arbitrary code via malicious .so files.
- 8.4 /10 HighCVE-2026-104810 Auth required
Mitel MiVoice Office 400 - Path Traversal
Mitel MiVoice Office 400 contains a path traversal vulnerability in the web portal's File Browser under Maintenance → File Management, letting authenticated attackers delete sensitive files outside intended directories, causing denial of service.
- 8.4 /10 HighCVE-2026-104809
DigitalCanion Mitel Linux - Remote Code Execution
DigitalCanion Mitel Linux virtual machine contains a command injection caused by loading an attacker-controlled .so file due to predictable module naming without integrity verification, letting attackers execute arbitrary code with privileged process context, exploit requires attacker to place malicious shared object with expected name.
- 8.5 /10 HighCVE-2026-104805
DigitalCanion Backup - Unrestricted File Upload
DigitalCanion backup restoration functionality contains an unrestricted file upload caused by improper validation of restored TGZ archive files, letting attackers with repository access place arbitrary files, potentially leading to root code execution, exploit requires access to backup repository.
- 8.8 /10 HighCVE-2026-104714 Auth required
Apache Struts - Race Condition
Apache Struts 2.0.0 to 2.3.37, 2.5.0 to 2.5.33, 6.0.0 to 6.11.0, and 7.0.0 to 7.3.0 contain a race condition caused by improper synchronization of date/time formatters in localized messages, letting concurrent requests leak data or cause server errors, exploit requires localized messages formatting date/time.
- 7.5 /10 HighCVE-2026-104712 No auth
Apache Struts - Denial of Service
Apache Struts 2.5.14 to 2.5.33, 6.0.0 to 6.11.0, and 7.0.0 to 7.3.0 contain an asymmetric resource consumption vulnerability caused by binding request parameters to BigDecimal properties rendered via Struts tag library, letting unauthenticated remote attackers exhaust server CPU and network capacity, exploit requires binding and rendering of BigDecimal properties.