High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 285 of 628

  • 7.8 /10 High
    CVE-2026-12171 No auth

    auto-changelog - Remote Code Execution

    auto-changelog before 2.6.1 contains a remote code execution caused by loading and executing untrusted configuration and modules from attacker-controlled repositories, letting attackers execute arbitrary code with user or CI privileges, exploit requires running auto-changelog on untrusted repository content.

  • 7.0 /10 High
    CVE-2026-105773 Auth required

    Canimaan Software ClamXAV - Privilege Escalation

    Canimaan Software ClamXAV 3.3 - 3.11 contains a local privilege escalation caused by a race condition and insufficient file validation in the Privileged Helper Tool, letting local attackers execute arbitrary code with system privileges, exploit requires local access.

  • 7.1 /10 High
    CVE-2026-105761 Auth required

    Dify - Broken Access Control

    Dify < 1.16.0 contains a broken access control vulnerability caused by lack of ownership verification in AppMCPServerController.put() for MCP server updates, letting authenticated workspace members modify other applications' MCP servers, exploit requires authentication as workspace member.

  • 7.5 /10 High
    CVE-2026-105744 PoC publicNo auth

    Docling - Command Injection

    Docling 2.94.0 to 2.132.0 contains a file read and write vulnerability caused by unrestricted TeX primitives in the Tectonic LaTeX engine, letting attackers read and overwrite files or execute shell commands, exploit requires enabling tikz_engine="tectonic" option.

  • 7.1 /10 High
    CVE-2026-105741 Auth required

    Langflow - Misconfiguration

    Langflow 1.5.0 to 1.10.3 contains an IP spoofing vulnerability caused by improper validation of X-Forwarded-For header in MCP configuration installation endpoint, letting authenticated attackers bypass local-only restriction and overwrite configuration files.

  • 7.1 /10 High
    CVE-2026-105699 Auth required

    Langflow - Broken Access Control

    Langflow 1.6.8 to 1.9.1 contains a broken access control vulnerability caused by lack of authorization checks on resource URIs in project-scoped MCP connections, letting authenticated users access other users' private flow files, exploit requires authenticated access to any project-scoped MCP endpoint.

  • 7.3 /10 High
    CVE-2026-105679 Auth required

    Ghost - Stored XSS

    Ghost 6.22.1 to 6.64.0 contains a stored XSS caused by improper content type restriction on uploaded files in the default local storage adapter, letting staff users host scripts that may compromise other admin sessions, exploit requires staff user privileges.

  • 7.2 /10 High
    CVE-2026-105677 Auth required

    Ghost - Remote Code Execution

    Ghost 6.10.3 to 6.64.0 contains a remote code execution caused by improper loading of theme translation files, letting authenticated administrators execute arbitrary code on the server via crafted themes.

  • 7.5 /10 High
    CVE-2026-105675 Auth required

    Ghost - Broken Access Control

    Ghost 4.39.0 to 6.64.0 contains a broken access control caused by staff users with view staff invites permission discovering secret tokens of pending invites, letting staff users escalate privileges by accepting invites, exploit requires staff user permission.

  • 7.3 /10 High
    CVE-2026-105651 Auth required

    Ghost - Stored XSS

    Ghost 5.94.0 to 6.64.0 contains a stored XSS caused by storing non-image files as bookmark icons or thumbnails, letting any staff user host arbitrary HTML on the site's domain, exploit requires staff user privileges.

  • 8.1 /10 High
    CVE-2026-105650 No auth

    Ghost - Stored XSS

    Ghost 2.1.0 to 6.64.0 contains a stored XSS caused by embedding URLs from attacker-controlled websites in post content, letting attackers execute scripts in editor, site, and emails, exploit requires crafted post content.

  • 7.3 /10 High
    CVE-2026-105649 Auth required

    Ghost - Stored XSS

    Ghost 4.22.0 to 6.65.0 contains a stored XSS caused by unsanitized SVG media thumbnails and SVG images uploaded with non-SVG extensions, letting staff users host scripts on the site domain, exploit requires staff user privileges.

  • 7.3 /10 High
    CVE-2026-105643 Auth required

    Ghost - Stored XSS

    Ghost 6.34.0 to 6.67.0 contains a stored cross-site scripting caused by insufficient sanitization of embed cards in the editor, letting any staff user execute scripts in other staff users' admin sessions, exploit requires staff user privileges.

  • 8.8 /10 High
    CVE-2026-105642 No auth

    Ghost - Command Injection

    Ghost 6.56.0 to 6.67.0 contains a command injection caused by vulnerable SVG handling in an image processing library, letting any staff user execute arbitrary commands on the server, exploit requires staff user privileges.

  • 7.4 /10 High
    CVE-2026-105635

    Plane - Broken Access Control

    Plane < 1.4.0 contains a broken access control caused by ProjectJoinEndpoint allowing unauthenticated access to full ProjectMemberInvite records and insufficient validation on POST, letting attackers accept invitations without original invite, exploit requires knowing invitation UUID.