High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 270 of 568
- 8.8 /10 HighCVE-2026-102125 Auth required
Kiteworks appliance - Broken Access Control
Kiteworks appliance contains a sandbox escape vulnerability caused by incomplete confinement of code running inside the document conversion sandbox, letting attackers with sandbox access read/modify data or disrupt service.
- 7.4 /10 HighCVE-2026-102123
Kiteworks Appliance - Unrestricted File Upload
Kiteworks appliance contains an unrestricted file write caused by improper confinement of user-supplied file paths in the setup interface, letting unauthenticated attackers write files to any writable location, exploit requires network access during provisioning or non-default configuration.
- 8.6 /10 HighCVE-2026-102121 No auth
Kiteworks Advanced Forms - Information Disclosure
Kiteworks Advanced Forms component contains an information disclosure caused by excessive data returned in form-rendering interface accessible without authentication, letting anonymous visitors retrieve form owner profile and deployment configuration, exploit requires knowing the form URL.
- 8.8 /10 HighCVE-2026-102120 Auth required
Kiteworks - Privilege Escalation
Kiteworks contains a privilege escalation caused by insufficient input validation in an internal cluster management function, letting attackers with code execution on one node run commands with elevated privileges on another node, exploit requires existing node access.
- 7.2 /10 HighCVE-2026-102119 Auth required
Unknown Product - Path Traversal
An optional non-default administrative feature contains a path traversal caused by improper file path validation, letting authenticated administrators move files outside designated directories, potentially leading to code execution.
- 7.8 /10 HighCVE-2026-102118 Auth required
Kiteworks - Privilege Escalation
Kiteworks contains a local privilege escalation caused by improper privilege management, letting attackers with low-privileged shell escalate to root privileges on the appliance, exploit requires existing shell access.
- 7.2 /10 HighCVE-2026-102117 Auth required
Product - Command Injection
A product with remote-support capability enabled contains a command injection caused by redirection of outbound support connection, letting authenticated System Administrators with key execute OS commands remotely, exploit requires admin authentication and key possession.
- 7.2 /10 HighCVE-2026-102116 Auth required
Kiteworks Email Protection Gateway - Remote Code Execution
Kiteworks Email Protection Gateway contains a file write vulnerability caused by insufficient validation, letting authenticated administrators write and execute files outside intended locations, potentially leading to remote code execution.
- 7.2 /10 HighCVE-2026-102114 Auth required
Kiteworks - Command Injection
Kiteworks contains a command injection caused by improper input handling, letting high-privileged authenticated administrators execute arbitrary OS commands as root, exploit requires administrative privileges.
- 7.8 /10 HighCVE-2026-102113 Auth required
Kiteworks - Privilege Escalation
Kiteworks contains a privilege escalation caused by unsafe handling of filesystem paths in a privileged routine, letting attackers with unprivileged backend service code execution escalate to root, exploit requires local access to service account.
- 7.8 /10 HighCVE-2026-102112 Auth required
Kiteworks - Privilege Escalation
Kiteworks contains a privilege escalation vulnerability caused by improper privilege management, letting attackers with unprivileged backend service account escalate to root and execute arbitrary commands, exploit requires local access to service account.
- 7.1 /10 HighCVE-2026-102109 Auth required
Kiteworks Secure Data Forms - SQL Injection
Kiteworks Secure Data Forms contains a sql injection caused by unsanitized user-derived account data in database queries, letting authenticated users inject SQL, exploit requires authenticated session and specific optional feature enabled.
- 7.2 /10 HighCVE-2026-102108 Auth required
Kiteworks Email Protection Gateway - Remote Code Execution
Kiteworks Email Protection Gateway contains an insecure deserialization vulnerability caused by insufficient validation of serialized objects in the cluster management interface, letting authenticated administrators execute arbitrary code, exploit requires specific queue-management privilege.
- 8.1 /10 HighCVE-2026-102101
Kiteworks Core - Insecure Deserialization
Kiteworks Core < 9.5.0 contains an insecure deserialization vulnerability caused by unsafe deserialization of crafted data, letting attackers potentially execute remote code, exploit requires attacker to influence deserialized data.
- 8.7 /10 HighCVE-2026-102100 Auth required
Kiteworks Core - Stored XSS
Kiteworks Core < 9.5.0 contains a stored cross-site scripting caused by improper sanitization of user-submitted content, letting authenticated users execute arbitrary JavaScript in other users' sessions, exploit requires victim to view malicious content.