High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 279 of 628

  • 7.5 /10 High
    CVE-2026-104636 No auth

    Gitea - Open Redirect

    Gitea contains an open redirect vulnerability caused by following HTTP redirects without revalidating the destination in Git operations, letting repository administrators bypass outbound host policies, exploit requires repository admin privileges.

  • 8.8 /10 High
    CVE-2026-104632 Auth required

    Gitea - Authentication Bypass

    Gitea Actions contains a workflow approval bypass caused by improper handling of rerun job states, letting users with Actions write access run unapproved fork pull request workflows on repository runners, exploit requires Actions enabled and matching runner registered.

  • 8.8 /10 High
    CVE-2026-104626 Auth required

    Gitea - Remote Code Execution

    Gitea contains a concurrency handling vulnerability in Actions workflow approval process, caused by improper job cancellation and re-queuing, letting fork pull request users execute code after maintainer approval, exploit requires maintainer approval and enabled Actions with a matching runner.

  • 7.3 /10 High
    CVE-2026-104406 No auth

    picu - Broken Access Control

    picu <= 3.10.1 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources, exploit requires no authentication.

  • 8.1 /10 High
    CVE-2026-104405 No auth

    GiveWP - Privilege Escalation

    GiveWP <= 4.17.0 contains a privilege escalation vulnerability allowing unauthenticated attackers to escalate privileges without authentication.

  • 7.1 /10 High
    CVE-2026-104395 No auth

    picu - Reflected XSS

    picu <= 3.10.1 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-104394 No auth

    Charitable - Stored XSS

    Charitable <= 1.8.12.3 contains an unauthenticated stored XSS caused by improper input sanitization, letting remote attackers execute scripts, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-104387 No auth

    PowerPress Podcasting - Broken Access Control

    PowerPress Podcasting <= 11.17.9 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 7.5 /10 High
    CVE-2026-104385 No auth

    Groundhogg - Sensitive Data Exposure

    Groundhogg <= 4.8.3 contains an information disclosure vulnerability caused by unauthenticated access, letting unauthenticated attackers access sensitive data remotely, exploit requires no authentication.

  • 7.6 /10 High
    CVE-2026-104073 Auth required

    NetBox - Server-Side Template Injection

    NetBox 2.9.5 before 4.7.0 contains a server-side template injection caused by exposing the raw Django HttpRequest object to the Jinja2 template context, letting low-privileged users steal session cookies and API tokens, exploit requires 'Can add custom links' permission.

  • 7.2 /10 High
    CVE-2026-104069 Auth required

    HortusFox - Remote Code Execution

    HortusFox < 6.2 contains a remote code execution caused by insecure extraction of uploaded ZIP archives in ThemeModule::startImport(), letting authenticated administrators execute arbitrary OS commands as the web-server user, exploit requires administrator authentication.

  • 7.5 /10 High
    CVE-2026-103831

    TrueLayer Magento 2 Plugin - Insecure Deserialization

    TrueLayer Magento 2 Plugin contains an insecure deserialization vulnerability in Psr16CacheAdapter caused by unrestricted use of PHP's unserialize() on cached data, letting attackers with cache write access execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-103670 No auth

    Gitea - Broken Access Control

    Gitea contains a broken access control vulnerability caused by improper concurrency group run cancellation logic in Actions, letting fork pull request users cancel trusted in-progress runs without approval, exploit requires fork pull request creation.

  • 8.1 /10 High
    CVE-2026-103504 Auth required

    Organization Team API - Broken Access Control

    An organization team's permission change via API with only the 'permission' field does not rebuild per-unit access, letting organization owners unintentionally retain higher access levels, exploit requires organization owner privileges.

  • 7.1 /10 High
    CVE-2026-103346 No auth

    Tomlister Payflex Payment Gateway - Reflected XSS

    Tomlister Payflex Payment Gateway <= 2.7.1 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted request.