High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 289 of 628
- 8.1 /10 HighCVE-2026-104974 Auth required
Plane - Authentication Bypass
Plane < 1.4.0 contains an authentication bypass caused by reactivation of deactivated accounts upon login, letting users with deactivated accounts silently reactivate themselves, exploit requires valid user credentials.
- 7.6 /10 HighCVE-2026-104973
Plane - Server Side Request Forgery
Plane < 1.4.0 contains a server side request forgery caused by improper IP validation in webhook delivery task allowing DNS rebinding to bypass SSRF protection, letting attackers perform SSRF via DNS rebinding, exploit requires DNS rebinding capability.
- 8.5 /10 HighCVE-2026-104971 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains broken access control caused by missing workspace authorization checks in DuplicateAssetEndpoint, WorkspaceFileAssetEndpoint, FileAssetEndpoint, and WorkspaceViewViewSet.retrieve, letting authenticated users access and modify assets across workspaces without membership, exploit requires authentication.
- 8.1 /10 HighCVE-2026-104970 No auth
Plane - Broken Access Control
Plane 0.13 to 1.4.0 contains a broken access control caused by lack of atomic transaction and locking in InstanceAdminSignUpEndpoint, letting unauthenticated attackers create multiple instance-admin accounts concurrently.
- 8.7 /10 HighCVE-2026-104968 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains an information disclosure vulnerability caused by lack of workspace-membership checks in GET /api/workspaces/{slug}/entity-search/, letting authenticated users access workspace member details without membership, exploit requires authentication and knowledge of workspace slug.
- 8.7 /10 HighCVE-2026-104966 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains a broken access control caused by improper verification of nested resource identifiers in workspace and project endpoints, letting authenticated users read or modify estimates and inject comments across workspaces, exploit requires authentication.
- 8.1 /10 HighCVE-2026-104905 PoC publicAuth required
FacturaScripts - Insecure Deserialization
FacturaScripts before version 2026.7 contains a PHP object injection caused by unsafe unserialize() usage in WidgetSelect::processFormData(), letting authenticated attackers delete arbitrary files via serialized XLSXWriter objects, exploit requires authentication.
- 8.7 /10 HighCVE-2026-104892 Auth required
Plane - Authentication Bypass
Plane < 1.4.0 contains a broken authentication vulnerability caused by aPITokenLogMiddleware logging API keys in plaintext, letting low-privilege attackers steal API keys and escalate privileges, exploit requires low privilege access.
- 7.5 /10 HighCVE-2026-104891 No auth
@insumermodel mppx-condition-gate - Authentication Bypass
@insumermodel mppx-condition-gate < 3.0.0 and mppx-token-gate < 1.0.4 contain an authentication bypass caused by accepting client-supplied wallet addresses without verifying control, letting unauthenticated attackers gain unauthorized free access, exploit requires attacker to specify a qualifying wallet address.
- 7.2 /10 HighCVE-2026-104890 Auth required
Kunstmaan CMS - Remote Code Execution
Kunstmaan CMS < 7.3.2 contains a remote code execution vulnerability caused by case-sensitive blacklisted extension checks in FileHandler, letting authenticated backend users upload executable files bypassing restrictions.
- 8.2 /10 HighCVE-2026-104852 No auth
GraphQL Tools - Prototype Pollution
GraphQL Tools utils package < 12.0.1 contains a prototype pollution caused by mergeDeep function merging inherited properties including __proto__, constructor, and prototype keys, letting unauthenticated GraphQL clients cause denial of service by breaking subsequent requests, exploit requires unauthenticated client to alias fields.
- 8.4 /10 HighCVE-2026-104811 Auth required
DigitalCanion SA - Remote Code Execution
DigitalCanion SA product contains a remote code execution vulnerability caused by improper validation of uploaded file types in Configuration → Services → Music on Hold, letting authenticated attackers execute arbitrary code via malicious .so files.
- 8.4 /10 HighCVE-2026-104810 Auth required
Mitel MiVoice Office 400 - Path Traversal
Mitel MiVoice Office 400 contains a path traversal vulnerability in the web portal's File Browser under Maintenance → File Management, letting authenticated attackers delete sensitive files outside intended directories, causing denial of service.
- 8.4 /10 HighCVE-2026-104809
DigitalCanion Mitel Linux - Remote Code Execution
DigitalCanion Mitel Linux virtual machine contains a command injection caused by loading an attacker-controlled .so file due to predictable module naming without integrity verification, letting attackers execute arbitrary code with privileged process context, exploit requires attacker to place malicious shared object with expected name.
- 8.5 /10 HighCVE-2026-104805
DigitalCanion Backup - Unrestricted File Upload
DigitalCanion backup restoration functionality contains an unrestricted file upload caused by improper validation of restored TGZ archive files, letting attackers with repository access place arbitrary files, potentially leading to root code execution, exploit requires access to backup repository.