High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 272 of 568
- 7.1 /10 HighCVE-2026-100507 No auth
If-So Dynamic Content Personalization - Reflected XSS
If-So Dynamic Content Personalization <= 1.10.1 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 8.9 /10 HighCVE-2026-100277
JetBrains YouTrack - Authentication Bypass
JetBrains YouTrack < 2026.2.19197 contains an account takeover vulnerability caused by replaying a notification signature, letting attackers take over user accounts, exploit requires replaying a valid notification signature.
- 8.2 /10 HighCVE-2026-100273 Auth required
JetBrains YouTrack - Authentication Bypass
JetBrains YouTrack < 2026.2.19197 contains an authorization bypass in the scripts debugger, letting attackers execute arbitrary code, exploit requires bypassing authorization.
- 7.7 /10 HighCVE-2026-100268 Auth required
JetBrains YouTrack - Broken Access Control
JetBrains YouTrack < 2026.2.19197 contains an information disclosure vulnerability caused by project administrators accessing comments from other projects via notification templates, letting project administrators read unauthorized comments, exploit requires project administrator privileges.
- 7.7 /10 HighCVE-2026-100266 Auth required
JetBrains Hub - Authentication Bypass
JetBrains Hub < 2026.2.52366 contains an authentication bypass caused by missing authorization, letting authenticated users send arbitrary emails from the server's trusted address, exploit requires user authentication.
- 7.6 /10 HighCVE-2026-100262 Auth required
JetBrains YouTrack - Broken Access Control
JetBrains YouTrack < 2026.2.18991 contains a broken access control vulnerability caused by missing authorization checks, letting users with read-only project access overwrite project notification templates, exploit requires read-only project access.
- 7.8 /10 HighCVE-2026-100256
JetBrains IntelliJ IDEA - Remote Code Execution
JetBrains IntelliJ IDEA < 2026.2.3 contains a remote code execution caused by unsafe Structural Search script constraints in untrusted projects, letting attackers execute arbitrary code remotely, exploit requires untrusted project context.
- 8.1 /10 HighCVE-2026-100255
JetBrains TeamCity - Authentication Bypass
JetBrains TeamCity < 2026.2, 2026.1.4, 2025.11.8 contains an administrator account takeover vulnerability caused by insecure password reset functionality, letting attackers gain administrator access, exploit requires password reset capability.
- 8.8 /10 HighCVE-2026-100254 Auth required
JetBrains TeamCity - Command Injection
JetBrains TeamCity before 2026.2, 2026.1.4, and 2025.11.8 contains a command injection caused by CRLF injection in Pipeline Git connection settings, letting authenticated users execute commands on Windows servers, exploit requires authentication.
- 8.8 /10 HighCVE-2026-100253 Auth required
JetBrains TeamCity - Remote Code Execution
JetBrains TeamCity < 2026.2, 2026.1.4, 2025.11.8 contains a sandbox escape vulnerability caused by versioned settings Kotlin DSL, letting attackers execute arbitrary code remotely, exploit requires crafted Kotlin DSL settings.
- 7.5 /10 HighCVE-2024-58387 CISA KEVNo auth
Inspur Haiyue HCM Cloud - Path Traversal
Inspur Haiyue HCM Cloud contains a path traversal vulnerability caused by unvalidated path parameters 'index' and 'ext' in /api/model_report/file/download, letting unauthenticated remote attackers read arbitrary files.
- 7.5 /10 HighCVE-2023-54403 CISA KEVNo auth
Yonyou U8 CRM - Arbitrary File Read
Yonyou U8 CRM < V16.5 and < V18 contains an arbitrary file read vulnerability caused by unvalidated filePath parameter in /ajax/getemaildata.php, letting unauthenticated attackers read sensitive files, exploit requires use of DontCheckLogin=1 parameter.
- 7.5 /10 HighCVE-2023-54402 CISA KEVNo auth
iDocView - Server-Side Request Forgery
iDocView contains a server-side request forgery caused by hardcoded default token value in /doc/upload endpoint, letting remote unauthenticated attackers fetch arbitrary URLs including file:// URIs, exploit requires use of default token.
- 7.1 /10 HighCVE-2026-98164
Linux Kernel KVM - Race Condition
Linux kernel KVM x86/mmu contains a logic flaw in write tracking across address spaces, caused by incomplete checks in kvm_gfn_is_write_tracked(), letting attackers potentially cause kernel crashes or memory corruption, exploit requires use of SMM and multiple address spaces.
- 7.5 /10 HighCVE-2026-97689 No auth
urllib3 - Denial of Service
urllib3 1.10.3 to 2.8.0 contains a denial of service caused by unbounded memory allocation in HTTPResponse.read_chunked and HTTPResponse.stream due to unbounded chunk-size buffering, letting malicious servers exhaust client memory, exploit requires a malicious HTTP server.