High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 267 of 568
- 7.5 /10 HighCVE-2026-103108 No auth
Pexip Infinity - Denial of Service
Pexip Infinity < 38.2, 39.0, 39.1, and 40.0 contain a denial of service caused by improper input validation in the media implementation, letting remote attackers trigger a software abort, exploit requires crafted input.
- 7.8 /10 HighCVE-2026-103106 Auth required
Pexip Infinity - Privilege Escalation
Pexip Infinity < 38.2, 39.0, 39.1, and 40.0 contain a privilege escalation caused by improper input validation in an internal service, letting local attackers escalate privileges to root, exploit requires arbitrary code execution or admin OS access.
- 8.8 /10 HighCVE-2026-103105 No auth
Pexip Infinity - Broken Access Control
Pexip Infinity < 38.2, 39.0, 39.1, and 40.0 contains an improper access control vulnerability in a product-internal API, letting attackers with local access execute arbitrary code as unprivileged users on other nodes, exploit requires local access to a node.
- 7.5 /10 HighCVE-2026-103104 No auth
Pexip Infinity - Denial of Service
Pexip Infinity < 38.2, 39.0, 39.1, and 40.0 contain a denial of service caused by improper input validation in the media implementation, letting remote attackers trigger a software abort, exploit requires crafted input.
- 8.6 /10 HighCVE-2026-103102 No auth
Pexip Infinity - Denial of Service
Pexip Infinity < 41.0 contains a denial of service caused by improper input validation in the signaling implementation, letting remote attackers trigger a software abort, exploit requires accessing a gateway call from a WebRTC/API client.
- 8.6 /10 HighCVE-2026-103101 No auth
Pexip Infinity - Denial of Service
Pexip Infinity 30.0 through 40.x before 41.0 contains a denial of service caused by improper input validation in the web server, letting malicious attackers render a node inaccessible, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-103100 No auth
Pexip Infinity - Denial of Service
Pexip Infinity < 40.1 contains a denial of service vulnerability caused by improper input validation in the signaling implementation, letting malicious attackers trigger software abort, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-103099 No auth
Pexip Infinity - Denial of Service
Pexip Infinity < 41.1 contains a denial of service vulnerability caused by improper input validation in the media implementation, letting remote attackers trigger a software abort, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-103088 No auth
Handlebars.java - Path Traversal
Handlebars.java before 4.5.5 contains a path traversal caused by inconsistent percent-encoding validation in template location handling, letting attackers read files outside the configured template base directory, exploit requires a Spring MVC application with file: template prefix and request-derived view name.
- 7.5 /10 HighCVE-2026-103055
AiSOC - Authentication Bypass
AiSOC < 12.0.0 contains a broken authentication caused by use of a hard-coded constant for JWT verification in realtime WebSocket and SSE service, letting unauthenticated attackers access cross-tenant live data, exploit requires AISOC_REALTIME_JWT_SECRET environment variable unset.
- 7.1 /10 HighCVE-2026-103054 Auth required
AiSOC - Authorization Bypass
AiSOC < 12.0.0 contains an authorization bypass caused by improper validation in the MSSP module's add_tenants_to_portfolio endpoint, letting authenticated users add arbitrary tenants to portfolios they own and access sensitive data.
- 7.5 /10 HighCVE-2026-103000 No auth
pypdf - Denial of Service
pypdf < 6.19.0 contains a denial of service caused by unusually large alphabetical page-label values in _page_labels.py, letting attackers consume excessive memory and potentially make the application unavailable, exploit requires crafted PDF input.
- 7.5 /10 HighCVE-2026-102999 No auth
pypdf - Denial of Service
pypdf < 6.19.0 contains a denial of service caused by reparsing the full attachment list for each content lookup in the dictionary-based attachments API, letting attackers cause long runtimes, exploit requires crafted PDF with many embedded files.
- 7.5 /10 HighCVE-2026-102998 No auth
pypdf - Denial of Service
pypdf < 6.19.0 contains a denial of service caused by inefficient appearance-stream generation in _appearance_stream.py when processing crafted PDFs with form field values, letting attackers cause excessive runtimes and application unavailability, exploit requires crafted PDF with form fields.
- 7.5 /10 HighCVE-2026-102997 No auth
pypdf - Denial of Service
pypdf prior to 6.18.1 contains a denial of service caused by inefficient byte-by-byte decompression of malformed /FlateDecode streams in filters.py, letting attackers cause long runtimes and application unavailability, exploit requires crafted PDF input.