High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 271 of 568
- 7.2 /10 HighCVE-2026-102099 Auth required
Kiteworks Core - Arbitrary File Write
Kiteworks Core < 9.5.0 contains an arbitrary file write caused by improper restriction of user-supplied file path in administrative export feature, letting authenticated administrators write files arbitrarily, exploit requires authenticated admin access.
- 7.2 /10 HighCVE-2026-102098 Auth required
Kiteworks Core - SQL Injection
Kiteworks Core < 9.5.0 contains a stored SQL injection caused by improper input sanitization in an administrative reporting feature, letting authenticated administrators read sensitive data and affect service availability, exploit requires authenticated admin access.
- 7.2 /10 HighCVE-2026-102097 Auth required
Kiteworks Email Protection Gateway - Remote Code Execution
Kiteworks Email Protection Gateway < 9.5.0 contains a remote code execution caused by insufficient validation of imported configuration by authenticated administrators, letting attackers execute arbitrary commands remotely, exploit requires authenticated administrator.
- 7.2 /10 HighCVE-2026-102096 Auth required
Kiteworks Core - OS Command Injection
Kiteworks Core < 9.5.0 contains an OS command injection caused by insufficient validation of uploaded configuration package contents, letting authenticated administrators execute arbitrary OS commands with elevated privileges.
- 7.2 /10 HighCVE-2026-102094 Auth required
Kiteworks Email Protection Gateway - Unsafe Reflection
Kiteworks Email Protection Gateway < 9.5.0 contains an unsafe reflection vulnerability caused by insufficient restriction on code loaded from imported mail-rule configurations, letting authenticated administrators execute unauthorized code, exploit requires mail-rule configuration privileges.
- 7.2 /10 HighCVE-2026-102093 Auth required
Kiteworks Core - Privilege Escalation
Kiteworks Core < 9.5.0 contains an improper privilege management vulnerability caused by incorrect enforcement of role assignment restrictions, letting authenticated administrative users with limited permissions escalate others to full system-administrator privileges, exploit requires authenticated administrative user with limited role-management permissions.
- 8.7 /10 HighCVE-2026-102092 Auth required
Kiteworks Core - Stored XSS
Kiteworks Core < 9.5.0 contains a stored XSS caused by improper sanitization of shared content previews, letting authenticated users execute arbitrary JavaScript in other users' sessions, exploit requires authentication.
- 7.5 /10 HighCVE-2026-102091 No auth
Kiteworks Secure Data Forms - Server-Side Request Forgery
Kiteworks Secure Data Forms < 9.5.0 contains a server-side request forgery caused by insufficient validation of outbound requests, letting unauthenticated remote attackers make arbitrary network requests and read responses.
- 7.2 /10 HighCVE-2026-102089 Auth required
Kiteworks Email Protection Gateway - Path Traversal
Kiteworks Email Protection Gateway < 9.5.0 contains a path traversal caused by an administrative import function, letting authenticated administrators write files to arbitrary locations, potentially leading to code execution.
- 7.8 /10 HighCVE-2026-101885 No auth
ZeroClaw - Path Traversal & Remote Code Execution
ZeroClaw < 0.8.5 with plugins-wasm feature contains a path traversal caused by lack of validation of wasm_path manifest field during plugin installation, letting attackers convince users to install crafted plugins that write arbitrary files outside the plugins directory, enabling code execution.
- 7.5 /10 HighCVE-2026-101884 Auth required
OpenClaw Windows Node - Command Injection
OpenClaw Windows Node before 2026.7.1 contains a command injection caused by incomplete environment-variable sanitization in system.run, letting attackers with gateway or agent access execute arbitrary code via allowed tools, exploit requires gateway or agent access.
- 8.8 /10 HighCVE-2026-101882 Auth required
OpenClaw Windows Node - Command Injection
OpenClaw Windows Node before 2026.7.1 contains a command injection caused by incomplete validation in system.execApprovals.set allowing wildcard-executable rules and abusable binaries, letting remote attackers execute arbitrary commands without operator checks, exploit requires remote access.
- 8.8 /10 HighCVE-2026-101880 Auth required
OpenClaw Windows Node - Command Injection
OpenClaw Windows Node < 2026.7.1 contains a command injection caused by ExecShellWrapperParser failing to split commands on pipe operators or extract command substitutions in system.run exec-approval policy, letting connected gateways or agents execute arbitrary commands on Windows hosts, exploit requires connected gateway or agent access.
- 7.3 /10 HighCVE-2026-101295
oc-mirror - Path Traversal & Arbitrary File Write
oc-mirror contains a path traversal and arbitrary file write vulnerability caused by improper validation of tar entry paths during operator catalog image extraction, letting attackers write files outside intended directories, exploit requires crafted catalog images.
- 7.1 /10 HighCVE-2026-100510 No auth
BoldGrid Post and Page Builder - Reflected XSS
Post and Page Builder by BoldGrid <= 1.27.14 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.