High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 277 of 568
- 8.5 /10 HighCVE-2026-86035 Auth required
Weblate - Command Injection
Weblate 4.11.1 through 2026.7.1 contains a command injection caused by improper handling of repository filenames starting with '-' in the Mercurial backend, letting authenticated users with project-scoped component.edit permission execute arbitrary commands, exploit requires specific permissions and use of Mercurial-backed RESX component.
- 8.1 /10 HighCVE-2026-84842 Auth required
IBM Guardium Data Protection - Path Traversal & Data Tampering
IBM Guardium Data Protection 12.2 contains a path traversal and arbitrary file deletion vulnerability caused by improper validation in the Datasource REST component, letting authenticated remote attackers delete files and cause denial of service or system integrity impact.
- 7.5 /10 HighCVE-2026-84784
OpenSSL - Allocation of Resources Without Limits or Throttling
OpenSSL QUIC stack contains an allocation of resources without limits caused by improper handling of NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames, letting remote attackers flood the stack and cause excessive memory allocation, exploit requires sending crafted QUIC frames without ACKs.
- 7.5 /10 HighCVE-2026-84783 No auth
OpenSSL - Use After Free
OpenSSL 4.0 contains a use-after-free vulnerability caused by concurrent caching of X.509 certificate extensions in multi-threaded environments, letting remote unauthenticated peers cause denial of service by crashing TLS clients or servers, exploit requires concurrent chain building to the same trusted CA certificate.
- 8.2 /10 HighCVE-2026-84782 No auth
OpenSSL - Out-of-Bounds Read
OpenSSL contains an out-of-bounds read caused by improper handling of suspended DTLS handshake message writes during retransmission, letting remote peers disclose heap memory or cause denial of service, exploit requires DTLS handshake in progress with suspended write.
- 8.7 /10 HighCVE-2026-84739 Auth required
GitLab CE/EE - Stored XSS
GitLab CE/EE >= 13.11 and < 19.2.7, 19.3 and < 19.3.3, 19.4 and < 19.4.1 contain a stored XSS caused by improper sanitization of path components in the merge request diff viewer, letting authenticated users execute arbitrary JavaScript in other users' browser sessions, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-84440 Auth required
IBM Guardium Data Protection - Command Injection
IBM Guardium Data Protection 12.2 contains a command injection caused by insufficient sanitization of policy alert text in SNMP alert notification functionality, letting authenticated attackers execute OS commands as root.
- 7.2 /10 HighCVE-2026-84422 Auth required
IBM Guardium Data Protection - Command Injection
IBM Guardium Data Protection 12.2 contains a command injection caused by improper input handling in the CLI certificate SMIME recipient deletion functionality, letting authenticated privileged CLI users execute arbitrary commands with root privileges.
- 8.8 /10 HighCVE-2026-84421 Auth required
IBM DataStage on Cloud Pak for Data - Remote Code Execution
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a remote code execution caused by improper validation of paths during archive extraction, letting remote authenticated attackers execute arbitrary code.
- 7.8 /10 HighCVE-2026-84414 Auth required
IBM i - Broken Access Control
IBM i 7.6, 7.5, 7.4, and 7.3 contain a broken access control vulnerability caused by improper validation of attacker-controlled file paths, letting local authenticated attackers change ownership of arbitrary files.
- 7.5 /10 HighCVE-2026-84409 No auth
Device Update Mechanism - Stored XSS & Remote Code Execution
The device contains a stored cross-site scripting vulnerability caused by unencrypted HTTP retrieval and unsafe HTML insertion of update metadata, letting attackers execute script and arbitrary code with root privileges, exploit requires attacker to control update metadata.
- 8.8 /10 HighCVE-2026-82804 Auth required
Apache DolphinScheduler - Command Injection
Apache DolphinScheduler < 3.4.3 contains a command injection caused by insufficient neutralization of shell metacharacters in the scriptPath parameter, letting authenticated users execute arbitrary commands with DolphinScheduler service privileges.
- 8.4 /10 HighCVE-2026-79403 No auth
Kilo Code - Command Injection
Kilo Code < 7.4.1 contains a command injection caused by improper access control in the permission/allow-everything endpoint, letting local attackers execute arbitrary code, exploit requires local access.
- 7.2 /10 HighCVE-2026-76728 Auth required
HPE Networking Instant ON APs - Server-Side Request Forgery
HPE Networking Instant ON APs contain a server-side request forgery caused by vulnerable API endpoint, letting authenticated remote attackers with high privileges execute arbitrary commands on the OS, exploit requires high privilege authentication.
- 7.2 /10 HighCVE-2026-76727 Auth required
HPE Networking Instant ON - Command Injection
HPE Networking Instant ON contains a command injection caused by insufficient input validation in an affected interface, letting authenticated remote attackers with high privileges execute arbitrary commands as privileged users, exploit requires authentication with high privileges.