High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 249 of 568
- 7.2 /10 HighCVE-2026-14995 No auth
Autoptimize WordPress Plugin - Stored XSS
Autoptimize WordPress plugin <= 3.1.15.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in REQUEST_URI path, letting unauthenticated attackers inject scripts executed by users, exploit requires Critical CSS feature active with valid API key.
- 8.1 /10 HighCVE-2026-14316
Generic - Buffer Overflow
A vulnerability in the revoked-key error path causes a heap buffer overflow due to insufficient buffer size for sprintf() formatted message, letting attackers cause memory corruption, exploit requires triggering the error path.
- 7.7 /10 HighCVE-2026-12544
Foreman - Server-Side Template Injection & Insecure Deserialization
Foreman contains a server-side template injection and insecure deserialization caused by multi-stage execution chain in foreman-rake initialization logic in /usr/share/foreman/config/settings.rb, letting remote attackers execute code and compromise infrastructure, exploit requires crafted input to configuration data.
- 8.2 /10 HighCVE-2026-12541 Auth required
Foreman - Command Injection
Foreman contains a command injection caused by improper sanitization of user-supplied input in foreman-rake db:dump and db:import_dump tasks, letting attackers with foreman-rake execution permissions run arbitrary OS commands.
- 8.2 /10 HighCVE-2026-12540 Auth required
Foreman - Command Injection
Foreman contains a command injection caused by inadequate shell neutralization of the request_id parameter in the foreman-rake errors:fetch_log task, letting attackers with sudo permissions execute arbitrary code.
- 7.5 /10 HighCVE-2026-12423 No auth
Foreman - Authentication Bypass
Foreman contains an authentication bypass caused by a semantic logic flaw in host_verifier.rb in the /unattended/provision API endpoint, letting attackers access kickstart templates without providing a token, exploit requires crafted request without token.
- 8.8 /10 HighCVE-2026-12405 Auth required
Red Hat Satellite - Command Injection
Red Hat Satellite API in rubygem-foreman_remote_execution contains a command injection caused by improper sanitization of the effective_user parameter in job templates marked as overridable, letting attackers with job execution permissions run arbitrary shell commands with execution user privileges, exploit requires permission to execute job templates.
- 8.1 /10 HighCVE-2026-104059 No auth
Lektor - Cross-Site Request Forgery
Lektor 3.3.14 and 3.4.0b15 contain a cross-site request forgery caused by lack of CSRF tokens, Origin/Referer validation, CORS configuration, and Host allowlisting in the admin API blueprint, letting unauthenticated attackers perform state-changing actions and data disclosure via DNS rebinding, exploit requires crafted cross-origin requests.
- 7.5 /10 HighCVE-2026-104057 No auth
Podgrab - Denial of Service
Podgrab contains an unauthenticated denial-of-service caused by unsynchronized concurrent access to shared maps in its WebSocket handler, letting remote attackers crash the process via data race, exploit requires no authentication.
- 8.2 /10 HighCVE-2026-104051 PoC publicNo auth
PictShare - Broken Access Control
PictShare < 3.7.1 contains an information disclosure vulnerability caused by the API::info() endpoint returning complete raw metadata without a field whitelist, letting unauthenticated attackers obtain secret delete_code and uploader metadata, exploit requires attacker to call the info API with a publicly visible file hash.
- 7.5 /10 HighCVE-2026-104020 No auth
Amazon Ion Python - Denial of Service
Amazon Ion Python < 0.15.0 contains a denial of service caused by uncontrolled recursion in the Ion reader, letting remote unauthenticated actors crash the application via crafted deeply nested Ion values.
- 8.8 /10 HighCVE-2026-104018 Auth required
Wind River VxWorks 7 - Privilege Escalation
Wind River VxWorks 7 <= 26.09 contains an improper privilege management vulnerability caused by missing privilege checks in the command shell, letting authenticated users with limited privileges escalate their privileges, exploit requires user authentication.
- 7.4 /10 HighCVE-2026-103921
GraphQL Tools - Authentication Bypass
GraphQL Tools < 1.1.35 contains a broken authentication caused by hardcoded TLS certificate rejection off in executor-legacy-ws buildWSLegacyExecutor(), letting network-positioned attackers disclose authentication material and modify subscription data, exploit requires use of legacy WebSocket executor in Node.js.
- 7.5 /10 HighCVE-2026-103761
Mooncake Transfer Engine - Denial of Service
Mooncake transfer engine through 0.3.13.post1 contains a denial of service caused by memory exhaustion in TransferMetadata::receivePeerNotify, letting unauthenticated attackers exhaust process memory by sending large notify frames repeatedly, exploit requires network access to handshake RPC port.
- 8.1 /10 HighCVE-2026-103758 Auth required
Obot - Authorization Bypass
Obot 0.21.1 through 0.24.1 contains an authorization bypass caused by omission of /mcp-connect-composite/ route in checkUI deny list, letting authenticated basic-role users proxy requests to restricted MCP servers.