High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 27 of 552
- 8.8 /10 HighCVE-2026-107350 Auth required
PgBouncer - Authentication Bypass
PgBouncer 1.17.0 through 1.26.0 contains an authentication bypass caused by improper handling of SCRAM authentication messages, letting remote attackers log in as any user if they know a valid password, exploit requires knowledge of a valid user's password.
- 7.5 /10 HighCVE-2026-107349 No auth
PgBouncer - Denial of Service
PgBouncer 1.20.0 through 1.26.0 contains a denial of service caused by an infinite loop triggered by a StartupMessage with an empty parameter name in options, letting unauthenticated remote attackers saturate CPU and make the service unresponsive, exploit requires sending crafted StartupMessage.
- 8.8 /10 HighCVE-2026-107126 No auth
WP Booking System - Stored XSS
WP Booking System WordPress plugin < 2.1.0.1 contains a stored cross-site scripting caused by unsanitized client-controllable request value stored and displayed in admin screen, letting unauthenticated attackers execute scripts in administrator sessions, exploit requires no authentication.
- 7.8 /10 HighCVE-2026-106931 Auth required
SiteGuard Server Edition - Command Injection
SiteGuard Server Edition contains an OS command injection caused by improper input handling, letting attackers execute arbitrary OS commands with root or SYSTEM privileges, exploit requires no special conditions.
- 8.8 /10 HighCVE-2026-106599 Auth required
Brainstorm Force SureCart - Insecure Deserialization
Brainstorm Force SureCart <= 4.9.3 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 8.7 /10 HighCVE-2026-106465 No auth
NetX Secure DTLS - Authentication Bypass
NetX Secure DTLS server contains a broken authentication caused by improper cookie verification in ClientHello parser, letting attackers bypass return-routability checks and complete handshakes with forged source addresses, exploit requires sending crafted ClientHello with any single cookie byte.
- 8.7 /10 HighCVE-2026-106464 No auth
Generic TLS Implementation - Out of Bounds Read
Affected software contains a buffer parsing vulnerability caused by improper length validation in _nx_secure_x509_parse_signature_data, letting remote attackers cause out-of-bounds read during TLS handshake, exploit requires crafted certificate input.
- 7.1 /10 HighCVE-2026-105874 No auth
Brainstorm Force SureCart - Reflected XSS
Brainstorm Force SureCart <= 4.9.3 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.
- 8.7 /10 HighCVE-2026-105659 No auth
Bandit - Uncontrolled Resource Consumption
Bandit >= 1.4.0 contains an uncontrolled resource consumption vulnerability caused by indefinite pinning of HTTP/2 stream processes via small WINDOW_UPDATE frames, letting unauthenticated remote attackers exhaust server resources, exploit requires continuous trickle of WINDOW_UPDATE frames.
- 8.0 /10 HighCVE-2026-105429 Auth required
NetBird - Command Injection
NetBird 0.60.0 through 0.74.6 contains a command injection caused by improper neutralization of special elements in SSH configuration manager, letting malicious peers execute arbitrary commands on other client hosts, exploit requires malicious or compromised peer.
- 7.6 /10 HighCVE-2026-105107 Auth required
Koha - SQL Injection
Koha < 24.11.19, 25.05.14, 25.11.08, 26.05.03 contains an SQL injection caused by unsanitized user input in reports/cat_issues_top.pl script, letting authenticated staff users with reports module permission execute arbitrary SQL and read sensitive data, exploit requires authenticated staff user with reports permission.
- 8.8 /10 HighCVE-2026-105106 Auth required
Koha - Command Injection
Koha contains a command injection caused by improper validation of the jobid parameter in Task Scheduler deletion path, letting authenticated staff users with schedule_tasks permission execute arbitrary OS commands, exploit requires authenticated staff user privileges.
- 8.5 /10 HighCVE-2026-105067 Auth required
Webnus Modern Events Calendar Lite - SQL Injection
Webnus Modern Events Calendar Lite < 7.37.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.
- 7.1 /10 HighCVE-2026-105066 No auth
SimplyRETS SimplyRETS Real Estate IDX - Reflected XSS
SimplyRETS SimplyRETS Real Estate IDX <= 3.2.9 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.
- 8.1 /10 HighCVE-2026-104995 No auth
WordPress BP Profile Search - Local File Inclusion
BP Profile Search plugin for WordPress <= 5.9 contains a local file inclusion vulnerability caused by improper validation of the 'ajax_template' value from the 'bps_directory' cookie during BuddyPress AJAX requests, letting unauthenticated attackers include arbitrary PHP files, exploit requires attacker control over HTTP_REFERER and cookie.