High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 232 of 568

  • 7.5 /10 High
    CVE-2026-105212 No auth

    ZITADEL - Authentication Bypass

    ZITADEL 3.x < 3.4.14 and 4.x < 4.16.2 contain an authentication bypass caused by acceptance of passkey or authenticator enrollment on identify-only login sessions before primary factor verification, letting unauthenticated attackers log in as users, exploit requires knowledge of victim's login name.

  • 8.1 /10 High
    CVE-2026-105211 No auth

    ZITADEL - Authentication Bypass

    ZITADEL < 4.17.1 contains an authentication bypass caused by OTP code exposure via returnCode delivery type in Login V2, letting unauthenticated attackers take over accounts including administrators, exploit requires victim to have OTP-Email and OTP-SMS enrolled.

  • 8.2 /10 High
    CVE-2026-105210 No auth

    ZITADEL - Authentication Bypass

    ZITADEL 3.x < 3.4.15 and 4.x < 4.17.1 contain a broken authentication caused by missing primary factor verification in hosted Login V1 UI second-factor enrollment, letting attackers enroll factors and enumerate users knowing only login names.

  • 7.7 /10 High
    CVE-2026-105208 Auth required

    ZITADEL - Broken Access Control

    ZITADEL 4.x < 4.17.3 and 3.x <= 3.4.15 contain a broken access control vulnerability caused by unauthenticated, malleable encryption of IdP intent tokens, letting authenticated users tamper tokens to hijack other users' external login intents, exploit requires predicting victim's intent identifier and winning a timing race.

  • 7.3 /10 High
    CVE-2026-105167 No auth

    kishor-23 food-waste-management-system - SQL Injection

    kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of the "location" argument in admin/donate.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105166 No auth

    kishor-23 food-waste-management-system - SQL Injection

    kishor-23 food-waste-management-system contains a sql injection caused by manipulation of the "image-choice" argument in the insert function of Food Donation Form component, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-105158 No auth

    RainyGao DocSys - SQL Injection

    RainyGao DocSys <= 2.02.85 contains a sql injection caused by manipulation of the "url" argument in BaseController.createDBForMysql in Database Management, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105149 No auth

    mooSocial - SQL Injection

    mooSocial <= 3.2.4 contains a sql injection caused by manipulation of the "rating" argument in /stores/all-products, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105148 No auth

    SciPhi-AI R2R - Server-Side Request Forgery

    SciPhi-AI R2R <= 3.6.6 contains a server-side request forgery caused by manipulation of the argument generation_config.api_base in Retrieval Completion API Endpoint, letting remote attackers make arbitrary requests, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-105147 No auth

    SciPhi-AI R2R - Hardcoded Credentials

    SciPhi-AI R2R <= 3.6.6 contains a hardcoded credentials vulnerability caused by manipulation of DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY in JWT Secret Handler, letting remote attackers exploit hardcoded secrets.

  • 7.3 /10 High
    CVE-2026-105133 CISA KEVPoC publicNo auth

    Ahsay AhsayCBS - Authentication Bypass

    Ahsay AhsayCBS <= 10.3.2 contains an authentication bypass caused by manipulation of the "random" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.

  • 7.2 /10 High
    CVE-2026-105126 Auth required

    LaraDashboard - Broken Access Control

    LaraDashboard < 1.4.8 contains a broken access control vulnerability caused by improper privilege management in role editing, letting authenticated admin users escalate to superadmin and execute code, exploit requires admin privileges.

  • 8.8 /10 High
    CVE-2026-105123 Auth required

    W (vincent-peugnet/wcms) - Remote Code Execution

    W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution caused by unvalidated path in POST /api/v0/media/upload/[*:path], letting authenticated editors write arbitrary files including executable PHP, exploit requires authenticated editor privileges.

  • 8.7 /10 High
    CVE-2026-105089 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo through 29.2.0 contains a stored XSS caused by unescaped rendering of malicious video trailer1 URL in YouPHPFlix2 templates and channel playlists, letting users with upload permission execute JavaScript in victims' browsers.

  • 8.7 /10 High
    CVE-2026-105086 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo 12.4 through 29.2.0 contains a stored XSS caused by improper handling of doubly-encoded entities in video titles, letting authenticated uploaders inject HTML that executes in multiple pages, exploit requires authenticated uploader privileges.