High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 288 of 628
- 7.3 /10 HighCVE-2026-105229 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of email, name, or gender arguments in signup.php User Registration Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.4 /10 HighCVE-2026-105223 No auth
maclof kubernetes-client - Authentication Bypass
maclof kubernetes-client < 0.32.0 contains a broken authentication caused by disabled TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when kubeconfig lacks certificate-authority-data, letting on-path attackers capture credentials and tamper API traffic, exploit requires a kubeconfig without certificate-authority-data.
- 7.3 /10 HighCVE-2026-105185 No auth
itsourcecode Online Admission System - SQL Injection
itsourcecode Online Admission System 1.0 contains a sql injection caused by manipulation of the "ID" argument in /admin/examinee.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105184 No auth
itsourcecode Online Admission System - SQL Injection
itsourcecode Online Admission System 1.0 contains a SQL injection caused by manipulation of the "ID" argument in /admin/creteria.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105183 No auth
itsourcecode Online Admission System - SQL Injection
itsourcecode Online Admission System 1.0 contains a sql injection caused by manipulation of the argument schedid in /admin/confirm.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105182 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "Title" argument in /reviewer_0/admins/assessments/activities/btn_functions.php?action=update, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105175 No auth
SourceCodester Drug Recommendation System - SQL Injection
SourceCodester Drug Recommendation System 1.0 contains a SQL injection caused by manipulation of the "cmdschool" argument in /Auth/add_student.php Student Registration component, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105172 No auth
itsourcecode Online Admission System - SQL Injection
itsourcecode Online Admission System 1.0 contains a sql injection caused by manipulation of the "User" argument in /login1.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105170 No auth
kishor-23 food-waste-management-system - Authentication Bypass
kishor-23 food-waste-management-system contains an authentication bypass caused by manipulation of the "sign" argument in admin/signup.php Admin Signup component, letting remote attackers bypass authentication, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105169 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of "order_id" and "delivery_person_id" arguments in delivery/delivery.php Take Order Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 8.7 /10 HighCVE-2026-104979 Auth required
Plane - Stored XSS
Plane < 1.4.0 contains a stored XSS caused by missing HTML content validation in IntakeIssuePublicViewSet.create, letting authenticated users inject arbitrary HTML that executes JavaScript in viewers' sessions, exploit requires published DeployBoard with intake enabled.
- 8.2 /10 HighCVE-2026-104978 Auth required
Plane - Authentication Bypass
Plane < 1.4.0 contains an authentication bypass caused by insufficient verification in project invitation endpoints, letting authenticated attackers enumerate and accept invitations by registering invited emails, exploit requires authenticated user access.
- 7.7 /10 HighCVE-2026-104977 Auth required
Plane - Server Side Request Forgery
Plane < 1.4.0 contains a server-side request forgery caused by incomplete hardening in work-item link unfurling, letting authenticated project members fetch internal targets and read responses, exploit requires authentication.
- 8.7 /10 HighCVE-2026-104976 Auth required
Plane - Server Side Request Forgery
Plane prior to 1.4.0 contains a server-side request forgery caused by insufficient validation of GITEA_HOST and avatar_url in the Gitea OAuth flow, letting authenticated Gitea users make internal network requests, exploit requires Gitea OAuth enabled and user login.
- 7.1 /10 HighCVE-2026-104975 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains a broken access control caused by missing membership check and project_id constraint in Spaces app asset endpoints, letting attackers read, overwrite, or restore assets across projects and workspaces, exploit requires no special privileges.