High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 242 of 568

  • 7.2 /10 High
    CVE-2026-104418 Auth required

    Ghost - Remote Code Execution

    Ghost > 6.10.3 < 6.64.0 contains a remote code execution caused by abuse of theme translation file loading, letting authenticated administrators execute arbitrary code on the server, exploit requires administrator access.

  • 7.5 /10 High
    CVE-2026-104416 Auth required

    Ghost - Broken Access Control

    Ghost >4.39.0 and <6.64.0 contains an information disclosure and privilege escalation vulnerability caused by improper access control in the Admin API, letting staff users view secret tokens and escalate privileges by accepting pending invites, exploit requires staff user with invite viewing permission.

  • 8.1 /10 High
    CVE-2026-104414 No auth

    Ghost - Stored XSS

    Ghost 2.5.0 < 6.64.0 contains a stored XSS caused by untrusted script injection via oEmbed photo responses in post content, letting attackers compromise admin sessions through editor, site, and emails, exploit requires embedding malicious URLs.

  • 7.3 /10 High
    CVE-2026-104413 Auth required

    Ghost - Stored XSS

    Ghost 5.94.0 < 6.64.0 contains a stored XSS caused by abuse of bookmark card image fetching allowing staff users to host arbitrary HTML, letting attackers compromise admin sessions, exploit requires attacker to be a staff user.

  • 7.3 /10 High
    CVE-2026-104411 Auth required

    Ghost - Stored XSS

    Ghost 6.22.1 < 6.64.0 contains a stored XSS caused by uploading files with extension-derived content types on the default local storage adapter, letting attackers compromise admin sessions, exploit requires attacker to be staff user.

  • 7.5 /10 High
    CVE-2026-104410 No auth

    SiYuan - Information Disclosure

    SiYuan before 3.8.5 contains an information disclosure vulnerability caused by improper access control in /api/export/preview endpoint, letting publish readers access password-protected and publish-disabled database rows, exploit requires attacker to be a publish reader.

  • 7.3 /10 High
    CVE-2026-104123 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "Title" argument in /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-104120 No auth

    modelcontextprotocol mcp-server-fetch & mcp-server-everything - Server-Side Request Forgery

    modelcontextprotocol mcp-server-fetch and mcp-server-everything <= 2026.6.4 contain a server-side request forgery caused by manipulation of the url/path argument in fetch_url function of Fetch Tool, letting remote attackers make arbitrary requests, exploit requires no special privileges.

  • 7.8 /10 High
    CVE-2026-104026 No auth

    Sapling SCM - Command Injection

    Sapling SCM < 0.2.20260929-102736 contains a command injection caused by control characters embedded in Git subtree URLs, letting attackers trigger code execution during read-only actions, exploit requires cloning a malicious repository.

  • 7.6 /10 High
    CVE-2026-103958 Auth required

    Loom for AWS - Server-Side Request Forgery

    Loom for AWS < 1.7.0 contains a server-side request forgery caused by improper validation of connection addresses in tool server and remote agent handling, letting authenticated remote users obtain container role credentials and read internal network responses, exploit requires authentication.

  • 7.5 /10 High
    CVE-2026-103885 No auth

    Apache Directory LDAP API - Denial of Service

    Apache Directory LDAP API >= 2.1.0 < 2.1.9 contains an asymmetric resource consumption vulnerability caused by processing malformed Telephone Numbers, letting attackers cause high CPU usage, exploit requires sending crafted input.

  • 7.5 /10 High
    CVE-2026-103880 No auth

    Apache Directory LDAP API - Denial of Service

    Apache Directory LDAP API 2.1.0 to < 2.1.9 contains an asymmetric resource consumption vulnerability caused by bcrypt password hashing with high cost factor, letting attackers cause server CPU exhaustion and denial of service, exploit requires crafted password with high bcrypt cost.

  • 7.5 /10 High
    CVE-2026-103878 No auth

    Apache Directory LDAP API - Cleartext Transmission

    Apache Directory LDAP API >= 2.1.0 < 2.1.9 contains a cleartext transmission vulnerability caused by StartTLS extended operation starting after a Search request, letting attackers intercept data in plain text before TLS handshake completion, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-103766 Auth required

    ClipBucket - SQL Injection

    ClipBucket v5 through 5.5.3-#197 contains an SQL injection caused by improper sanitization of the delete parameter in admin_area/ads_manager.php, letting authenticated users with ad_manager_access inject SQL to extract or modify data.

  • 8.8 /10 High
    CVE-2026-103631 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 154.0.8037.97 contains a buffer overflow in WebRTC, caused by improper handling of data, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.