High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 281 of 628
- 8.7 /10 HighCVE-2026-101157 No auth
Unknown Product - Stored XSS
An unspecified product contains a stored XSS vulnerability caused by improper sanitization of user input, letting unauthenticated attackers with adjacent-network access inject malicious content that executes when authenticated users view it.
- 8.4 /10 HighCVE-2026-101156 Auth required
Unknown Product - Stored XSS
An unspecified product contains a stored XSS caused by improper sanitization of configuration input, letting authenticated high-privilege administrators execute scripts in other authenticated users' browsers, exploit requires high-privilege admin access.
- 7.2 /10 HighCVE-2026-101154 Auth required
Platform - Broken Access Control
The platform contains a file read and write vulnerability caused by specially crafted requests or file uploads to the Network Provisioning Image Repository, letting authenticated remote attackers with specific permissions access or modify files beyond intended scope.
- 8.0 /10 HighCVE-2026-101153 Auth required
CloudVision Portal & Sensor - Path Traversal
CloudVision Portal (on-premises) and CloudVision Sensor contain a path traversal caused by insufficient validation, letting authenticated users with high privileges extract unintended data from the Sensor.
- 8.0 /10 HighCVE-2026-101152 No auth
CloudVision - Authentication Bypass
CloudVision contains a broken authentication caused by insufficient validation in the Single Sign-On (SSO) login flow, letting remote unauthenticated attackers redirect authentication material to attacker-controlled URLs, exploit requires user interaction.
- 7.7 /10 HighCVE-2026-101027 Auth required
Gitea - Server Side Request Forgery
Gitea contains a server-side request forgery caused by insufficient validation of resolved addresses for allowed hostnames in migrations, letting attackers bypass local network restrictions and access internal services, exploit requires control over DNS of allowed hostname.
- 8.1 /10 HighCVE-2025-45871 Auth required
LogicalDOC Enterprise - SQL Injection
LogicalDOC Enterprise <= 9.1.1 contains a blind SQL injection caused by manipulation of workflow template name in WorkflowsDataServlet, letting authenticated users manipulate SQL queries.
- 7.1 /10 HighCVE-2026-97309 Auth required
Webful Creations RepairBuddy - Broken Access Control
Webful Creations RepairBuddy <= 4.1226 contains a broken access control vulnerability caused by missing authorization checks, letting attackers retrieve embedded sensitive data, exploit requires no special privileges.
- 7.6 /10 HighCVE-2026-97303 Auth required
Apps Mav Scratch & Win – Giveaways and Contests - Broken Access Control
Apps Mav Scratch & Win – Giveaways and Contests <= 3.0.2 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-97257 Auth required
PressTigers Simple Event Planner - Insecure Deserialization
PressTigers Simple Event Planner <= 1.5.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-95265 No auth
Feehi CMS - Server Side Request Forgery
Feehi CMS 2.1.1 contains a server side request forgery caused by insufficient private-IP validation in the UEditor catchimage endpoint, letting attackers probe internal HTTP services, exploit requires network access.
- 7.2 /10 HighCVE-2026-95263 Auth required
Feehi CMS - Broken Access Control
Feehi CMS 2.1.1 contains an incorrect access control vulnerability caused by lack of protection on the built-in super administrator account, letting low-privilege backend administrators change its password without the old password.
- 8.2 /10 HighCVE-2026-94201 No auth
Ash - Denial of Service
Ash 3.5.1 to < 3.34.3 contains a denial of service caused by unsafe atom interning in :atom-typed attributes with unsafe_to_atom?: true, letting attackers exhaust the atom table and crash the node, exploit requires attacker-controlled filter values.
- 7.2 /10 HighCVE-2026-93617 Auth required
Sunshine Photo Cart - Insecure Deserialization
Sunshine Photo Cart <= 3.7.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-93318
BuildKit - Code Injection
BuildKit contains a code injection vulnerability caused by trusting advertised DiffIDs without validating actual layer contents, letting attackers run malicious code in victim builds, exploit requires shared or persistent cache usage.