High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 241 of 568

  • 7.5 /10 High
    CVE-2026-104462 No auth

    YesWiki - SQL Injection

    YesWiki < 4.6.7 contains an SQL injection caused by unescaped 'tags' attribute concatenation in Bazar nuagetag action, letting attackers with page-write access exfiltrate password hashes and arbitrary data, exploit requires page-write access.

  • 7.5 /10 High
    CVE-2026-104460 No auth

    YesWiki - SQL Injection

    YesWiki < 4.6.7 contains a blind SQL injection caused by unescaped Bazar list option ids concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php, letting anonymous attackers read arbitrary database data.

  • 8.6 /10 High
    CVE-2026-104457 No auth

    YesWiki - SQL Injection

    YesWiki before 4.6.7 contains an SQL injection caused by unescaped filterN attribute tokens in the Bazar filtertags action, letting unauthenticated attackers read arbitrary database data, exploit requires default installation with filtertags markup.

  • 7.6 /10 High
    CVE-2026-104456 Auth required

    YesWiki - SQL Injection

    YesWiki < 4.6.7 contains a second-order SQL injection caused by unescaped stored username concatenated into a read-ACL LIKE clause in AclService::updateRequestWithACL, letting attackers bypass read ACLs and read database contents, exploit requires attacker to self-register an account with crafted username.

  • 8.1 /10 High
    CVE-2026-104448 No auth

    YesWiki - Cross-Site Request Forgery

    YesWiki < 4.6.7 contains a cross-site request forgery caused by lack of CSRF token validation in ajaxdeletepage handler, letting attackers delete arbitrary pages by luring logged-in administrators or page owners, exploit requires victim to be logged in and visit crafted link.

  • 7.1 /10 High
    CVE-2026-104447 No auth

    YesWiki - Cross-Site Request Forgery

    YesWiki < 4.6.7 contains a cross-site request forgery caused by unprotected GET requests in autoupdate UpdateAction, letting attackers delete installed packages by tricking logged-in administrators.

  • 8.2 /10 High
    CVE-2026-104445 No auth

    YesWiki - Authentication Bypass

    YesWiki < 4.6.7 contains an authentication bypass caused by failure to bind verified HTTP signature signer to activity actor in ActivityPub inbox, letting unauthenticated attackers delete or overwrite federated entries, exploit requires attacker to have any ActivityPub keypair.

  • 7.1 /10 High
    CVE-2026-104444 Auth required

    YesWiki - Authorization Bypass

    YesWiki < 4.6.7 contains an authorization bypass caused by improper access control in the comments API editComment route, letting authenticated low-privilege users overwrite arbitrary pages or comments, exploit requires authentication.

  • 8.1 /10 High
    CVE-2026-104443 Auth required

    YesWiki - Broken Access Control

    YesWiki < 4.6.7 contains a broken access control caused by empty-filter scope bypass in the triples delete API, letting authenticated users delete or forge arbitrary semantic triples, exploit requires authentication.

  • 7.4 /10 High
    CVE-2026-104437 No auth

    Zebra - Consensus Divergence

    Zebra < 4.4.0 contains a consensus divergence vulnerability caused by incorrect ZIP-244 digest computation for SIGHASH_SINGLE inputs lacking outputs in V5 transparent signature verification, letting attackers craft invalid blocks, exploit requires crafting specific V5 transactions.

  • 7.4 /10 High
    CVE-2026-104435 No auth

    Zebra zebrad & zebra-script - Authentication Bypass

    Zebra zebrad 4.4.0 and zebra-script 6.0.0 contain a consensus rule enforcement bypass caused by accepting V5 transparent inputs signed with SIGHASH_SINGLE lacking corresponding outputs, letting attackers cause network consensus split, exploit requires crafted V5 transactions.

  • 7.5 /10 High
    CVE-2026-104431 No auth

    Zebra - Denial of Service

    Zebra < 6.0.0 contains a denial of service vulnerability caused by unauthenticated peers submitting mempool transactions with expensive synchronous script verification, letting attackers stall Tokio workers and render nodes unresponsive, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-104430 No auth

    Zebra zebrad & zebra-script - Denial of Service

    Zebra zebrad 4.5.0 and zebra-script 7.0.0 contain a consensus divergence caused by incorrect counting of P2SH redeem script signature operations in legacy mode, letting remote attackers cause Zebra nodes to reject valid blocks, exploit requires broadcasting crafted P2SH spends.

  • 7.5 /10 High
    CVE-2026-104423 No auth

    Zebra - Denial of Service

    Zebra (zebrad) < 6.2.1 contains an asymmetric resource consumption vulnerability caused by unauthenticated peers pushing invalid Halo2 proofs in V6 mempool transactions, letting attackers stall block verification by flooding verification queue, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-104422 No auth

    Zebra - Denial of Service

    Zebra (zebrad) < 6.3.0 contains a denial of service caused by unvalidated coinbase scriptSig height in block sync download path, letting malicious peers delay block discovery without penalty, exploit requires network interaction with peer.