High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 248 of 568
- 7.6 /10 HighCVE-2026-55232 Auth required
Vvveb - Server Side Request Forgery
Vvveb < 1.0.8.6 contains a server side request forgery caused by improper IPv6 handling in SSRF guard and oEmbed proxy, letting authenticated admin users read internal services and cloud metadata via IPv6 or AAAA-only domains.
- 7.2 /10 HighCVE-2026-55231 Auth required
Vvveb - Path Traversal
Vvveb < 1.0.8.6 contains a path traversal caused by a flawed central path sanitizer, letting authenticated admin-panel users with backup access read and delete arbitrary files, exploit requires admin-panel backup access.
- 8.7 /10 HighCVE-2026-55230 Auth required
Vvveb - Stored XSS
Vvveb < 1.0.8.6 contains a stored XSS caused by improper HTML sanitization failing to strip event-handler attributes with > character in quoted values, letting low-privilege content authors execute JavaScript in visitors' and admins' browsers, exploit requires author or contributor role.
- 8.7 /10 HighCVE-2026-54049 Auth required
Sakai - Stored XSS
Sakai 23.0 < 23.5, 25.0 < 25.3 contains a stored XSS caused by lack of HTML sanitization in Conversations tool messages and unsafe rendering with LitElement's unsafeHTML(), letting authenticated users inject arbitrary scripts executed by other users, exploit requires authenticated user access to Conversations tool.
- 7.2 /10 HighCVE-2026-53964 Auth required
Document Merge Service - Remote Code Execution
Document Merge Service < 9.1.0 contains a server-side template injection caused by unsafe processing of XLSX templates using npn-sandboxed Jinja environment, letting remote attackers execute code as document-merge-server user, exploit requires crafted XLSX template.
- 7.5 /10 HighCVE-2026-51888 No auth
langflow-ai langflow - Path Traversal
langflow-ai langflow <= 1.8.4 contains a path traversal caused by lack of boundary enforcement in knowledge_bases-create_knowledge_base HTTP POST endpoint, letting attackers write files outside intended workspace, exploit requires HTTP access.
- 7.5 /10 HighCVE-2026-51874 No auth
Devika - Path Traversal
Devika v1.0 contains a path traversal vulnerability caused by improper validation in the Patcher Agent save_code_to_project function, letting attackers write files outside the intended project workspace, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-51873 Auth required
Devika - Directory Traversal
Devika v1.0 contains a directory traversal caused by improper validation in Coder.save_code_to_project function, letting attackers write files outside the intended project workspace, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-48005 No auth
Apache HTTP Server - Authentication Bypass
Apache Software Foundation Apache HTTP Server < 2.4.69 contains a denial of service caused by missing authentication checks in mod_auth_digest, letting unauthenticated remote clients cause forced re-authentication via forged Authorization headers when Digest authentication with AuthDigestNcCheck is enabled, exploit requires Digest authentication enabled with AuthDigestNcCheck.
- 7.5 /10 HighCVE-2026-47360
Apache HTTP Server - Exposure of Sensitive Information
Apache HTTP Server 2.4.0 through 2.4.68 contains an information disclosure vulnerability caused by SessionCookieRemove changes across internal redirects in mod_session_cookie module, letting unauthorized actors access session cookies, exploit requires internal redirects.
- 7.5 /10 HighCVE-2026-46729 No auth
Apache HTTP Server - Null Pointer Dereference
Apache HTTP Server 2.4.0 through 2.4.68 contains a null pointer dereference caused by improper handling in mod_heartmonitor unicast listener, letting attackers cause denial of service, exploit requires network access.
- 8.8 /10 HighCVE-2026-19807 Auth required
ByteCoreStack MCP Connector for AI Tools - Privilege Escalation
ByteCoreStack MCP Connector for AI Tools WordPress plugin <= 1.2.3 contains a privilege escalation caused by insufficient meta key protection in wp_update_user_meta within execute_tool, letting authenticated subscribers escalate to administrator via MCP JSON-RPC, exploit requires subscriber-level access.
- 8.7 /10 HighCVE-2026-19253 No auth
Cache Enabler WordPress Plugin - Path Traversal
Cache Enabler WordPress plugin < 1.8.17 contains a path traversal caused by improper URL validation in the cache purge routine, letting unauthenticated attackers delete arbitrary files and directories, exploit requires another plugin passing a request-derived URL.
- 8.1 /10 HighCVE-2026-15983 Auth required
Super Forms – Drag & Drop Form Builder - Arbitrary File Deletion
Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains an arbitrary file/directory deletion vulnerability caused by lack of capability checks and improper sanitization in AJAX handlers, letting authenticated Subscriber-level users delete arbitrary files/directories, exploit requires authenticated Subscriber-level access.
- 7.4 /10 HighCVE-2026-15911 PoC publicNo auth
Confluent Kafka Python client - Information Disclosure
Confluent Kafka Python client contains a sensitive information disclosure caused by improper TLS certificate validation in HashiCorp Vault KMS integration, letting remote attackers obtain sensitive information, exploit requires network access.