High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 251 of 568
- 7.5 /10 HighCVE-2026-103272 No auth
Ghost - Broken Access Control
Ghost 2.10.0 < 6.63.0 contains a staff enumeration vulnerability caused by discrepancies in content API metadata responses, letting unauthenticated attackers leak user data, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-103271 No auth
Ghost - Broken Access Control
Ghost 4.0.0 < 6.63.0 contains an information disclosure vulnerability caused by improper access control in the content API, letting unauthenticated visitors access gated post content, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-103268 Auth required
Ghost - Authentication Bypass
Ghost < 6.62.0 contains an authentication bypass caused by allowing suspended staff users to reactivate accounts via self-service password reset, letting suspended staff attackers regain active access and privileges, exploit requires suspended staff credentials.
- 7.1 /10 HighCVE-2026-103266 No auth
Ghost - Cross-Site Scripting
Ghost 5.2.0 through < 6.62.0 contains a cross-site scripting caused by abuse of Stripe Checkout flow allowing modification of member data and newsletter content, letting remote attackers inject HTML or scripts, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-103262 No auth
Tornado - Denial of Service
Tornado < 6.5.9 contains a denial of service vulnerability caused by unbounded memory accumulation in CurlAsyncHTTPClient when processing compressed responses, letting remote attackers cause application crash via decompression bomb, exploit requires sending crafted compressed response.
- 7.6 /10 HighCVE-2026-103259
n8n - Authentication Bypass
n8n < 2.39.6 and 2.40.0 < 2.40.1 contain a session token leakage caused by fallback resolver manipulation in Dynamic Credentials authorize and revoke endpoints, letting attackers with resolver registration capture collaborators' session tokens, exploit requires resolver registration capability.
- 7.7 /10 HighCVE-2026-103257 No auth
n8n - Path Traversal
n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a path traversal caused by improper validation of resource identifiers in the n8n node, letting attackers access unauthorized workflows, executions, and credential secrets, exploit requires crafted resource IDs.
- 7.1 /10 HighCVE-2026-103256 Auth required
n8n - Information Disclosure
n8n < 2.39.6 and 2.40.0 < 2.40.1 contain a credentials leak caused by sending unencrypted passwords to unvalidated hosts in Wekan and Baserow username-and-password credentials, letting attackers with credential update permissions leak passwords, exploit requires credential update permissions.
- 8.7 /10 HighCVE-2026-103253 No auth
n8n - SQL Injection
n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain an SQL injection caused by improper sanitization in Oracle Database node's Delete Table Drop operation, letting attackers execute arbitrary SQL commands with database privileges, exploit requires access to the node.
- 7.7 /10 HighCVE-2026-103252 Auth required
n8n - Authorization Bypass
n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain an authorization bypass caused by lack of caller access validation in the credential test endpoint, letting attackers exfiltrate sensitive variables by specifying arbitrary project IDs, exploit requires network access.
- 7.1 /10 HighCVE-2026-103251
n8n - Authentication Bypass & Remote Code Execution
n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a validation bypass caused by improper checks in the community package installation handler for queue mode deployments, letting attackers with Redis write access install arbitrary npm packages without authentication.
- 8.1 /10 HighCVE-2026-103250 No auth
n8n - NoSQL Injection
n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a NoSQL injection caused by improper validation of the sessionId parameter in the MongoDB Chat Memory node, letting unauthenticated attackers access and modify other users' conversation histories, exploit requires no authentication.
- 7.6 /10 HighCVE-2026-103249 Auth required
n8n - Stored XSS
n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a stored XSS caused by improper sanitization of Resource Locator parameter dropdown link, letting workflow authors execute arbitrary JavaScript in editor origin when other users interact with the node dropdown, exploit requires other users to open the node dropdown and click the external-link icon.
- 8.5 /10 HighCVE-2026-103247 Auth required
n8n - Broken Access Control
n8n < 1.123.80 contains a credential tampering vulnerability caused by duplicate node IDs bypassing workflow credential tamper guard, letting attackers with editor access retain victim credentials and redirect secrets.
- 7.7 /10 HighCVE-2026-103246 Auth required
n8n - Broken Access Control
n8n < 2.39.6 and 2.40.0 < 2.40.1 contain an information disclosure vulnerability caused by failure to validate credential ownership during inline agent node-tool introspection, letting attackers decrypt and exfiltrate plaintext secrets without ownership verification.