High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 23 of 725
- 7.8 /10 HighCVE-2026-119528 No auth
GIMP - Buffer Overflow
GIMP contains a stack-based buffer overflow caused by incorrect destination size usage in the PSD plug-in's image resource header loader, letting attackers execute arbitrary code by opening crafted PSD files, exploit requires opening crafted PSD files.
- 7.5 /10 HighCVE-2026-119426 No auth
phpMyAdmin - Cross-Site Request Forgery
phpMyAdmin <= 5.2.3 contains a cross-site request forgery vulnerability caused by bypassing CSRF token checks on non-AJAX POST requests, letting remote attackers execute arbitrary SQL with victim's database privileges via crafted cross-site POSTs.
- 8.8 /10 HighCVE-2026-119420 Auth required
Lago - Authentication Bypass
Lago <= 1.55.0 contains an authentication bypass caused by missing password check in acceptInvite mutation, letting organization administrators obtain session tokens and access sensitive data, exploit requires attacker to invite victim's email.
- 8.1 /10 HighCVE-2026-119419 No auth
CakePHP - SQL Injection
CakePHP <= 5.4.3 contains an SQL injection caused by unvalidated collation values in StringExpression and IdentifierExpression, letting attackers inject SQL via COLLATE clause, exploit requires attacker control of collation input.
- 8.1 /10 HighCVE-2026-119418 No auth
CakePHP - SQL Injection
CakePHP <= 5.4.3 contains an SQL injection caused by unvalidated frame offsets and directions in WindowExpression::range() and frame(), letting attackers execute SQL with database privileges, exploit requires crafted user input forwarded to OVER clause.
- 7.2 /10 HighCVE-2026-119409 Auth required
OPNsense - Command Injection
OPNsense < 26.7.8 contains a command injection caused by improper evaluation of a malicious firmware mirror URL in opnsense-update, letting authenticated users with System: Firmware privilege execute commands as root, exploit requires System: Firmware privilege.
- 8.8 /10 HighCVE-2026-119408 Auth required
n8n - Remote Code Execution
n8n < 2.42.6, 2.43.x < 2.43.3, and 3.x < 3.0.1 contain a remote code execution caused by deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation, letting authenticated users execute JavaScript in the main process, exploit requires workflow creation or modification privileges.
- 7.1 /10 HighCVE-2026-119407 No auth
Element Web & Desktop - Authentication Bypass
Element Web and Element Desktop < 1.12.32 contain an authentication bypass caused by accepting guest credentials from URL fragment parameters in loadSession, letting remote unauthenticated attackers log out users and clear local stores, exploit requires user to open crafted link.
- 7.8 /10 HighCVE-2026-119379 No auth
SQLite - Buffer Overflow
SQLite before 3.54.0 with session extension contains a heap buffer overflow caused by improper handling of crafted changesets in sqlite3changeset_apply(), letting attackers corrupt heap memory remotely, exploit requires crafted changesets.
- 7.8 /10 HighCVE-2026-119374
SQLite - Buffer Overflow
SQLite < 3.54.0 built with FTS5 contains a heap buffer overflow caused by crafted footer key offsets in fts5DoSecureDelete(), letting attackers corrupt heap memory and crash the application, exploit requires crafted database file with corrupted FTS5 index and secure-delete enabled.
- 7.8 /10 HighCVE-2026-119373
SQLite - Buffer Overflow
SQLite < 3.54.0 built with FTS5 contains a heap buffer overflow caused by undersized output buffer in fts5MergeRowidLists() when merging detail=none prefix doclists, letting attackers corrupt heap memory and crash the process, exploit requires ability to populate detail=none FTS5 table with negative rowids and run prefix MATCH query.
- 7.1 /10 HighCVE-2026-119337 Auth required
RAGFlow - Broken Access Control
RAGFlow 0.25.2 to < 0.27.3 contains a broken access control caused by missing authorization checks before UserCanvasService.accessible(), letting authenticated users access private agents of others and read outputs, exploit requires authentication and knowledge of another user's private agent UUID.
- 7.8 /10 HighCVE-2026-119336 Auth required
Pi-hole - Race Condition
Pi-hole 6.4.2 to < 6.5 contains a race condition and symlink vulnerability in the root-run updatecheck.sh cron job, letting attackers with pihole user privileges modify root-owned files or change permissions, exploit requires attacker to have pihole user access.
- 7.8 /10 HighCVE-2026-119335 Auth required
Pi-hole - Command Injection & Privilege Escalation
Pi-hole prior to 6.5 contains a command injection caused by improper validation of the pihole-owned PID file in advanced/Scripts/utils.sh getFTLPID(), letting attackers with pihole user code execution escalate to root via Bash evaluation, exploit requires code execution as pihole user.
- 7.8 /10 HighCVE-2026-119333 No auth
draw.io Desktop - Command Injection
draw.io Desktop < 31.5.2 contains a command injection caused by launching powershell and attrib by bare executable name in electron.js, letting attacker-controlled executables run when opening diagrams, exploit requires victim to open attacker-supplied files.