High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 290 of 628
- 8.8 /10 HighCVE-2026-104714 Auth required
Apache Struts - Race Condition
Apache Struts 2.0.0 to 2.3.37, 2.5.0 to 2.5.33, 6.0.0 to 6.11.0, and 7.0.0 to 7.3.0 contain a race condition caused by improper synchronization of date/time formatters in localized messages, letting concurrent requests leak data or cause server errors, exploit requires localized messages formatting date/time.
- 7.5 /10 HighCVE-2026-104712 No auth
Apache Struts - Denial of Service
Apache Struts 2.5.14 to 2.5.33, 6.0.0 to 6.11.0, and 7.0.0 to 7.3.0 contain an asymmetric resource consumption vulnerability caused by binding request parameters to BigDecimal properties rendered via Struts tag library, letting unauthenticated remote attackers exhaust server CPU and network capacity, exploit requires binding and rendering of BigDecimal properties.
- 8.4 /10 HighCVE-2026-104706 Auth required
DigitalCanion Portal - Path Traversal
DigitalCanion portal contains a path traversal vulnerability caused by improper input validation in Administration -> View Logs menu, letting remote attackers view or download sensitive system files, exploit requires network access.
- 7.6 /10 HighCVE-2026-104408 Auth required
Groundhogg Groundhogg - SQL Injection
Groundhogg Groundhogg <= 4.8.3 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-104407 No auth
Blubrry Podcasting PowerPress Podcasting - Cross-Site Request Forgery
Blubrry Podcasting PowerPress Podcasting <= 11.17.9 contains a cross site request forgery caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.
- 8.5 /10 HighCVE-2026-104389 Auth required
Sirv Sirv - SQL Injection
Sirv Sirv <= 8.2.5 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.
- 7.5 /10 HighCVE-2026-103507 Auth required
Perforce P4 Search - Unrestricted File Upload
Perforce P4 Search < 2026.4.2 contains an unrestricted file write vulnerability caused by insufficient path restrictions in the logging configuration interface, letting attackers with service authentication token write arbitrary files, exploit requires service authentication token.
- 7.2 /10 HighCVE-2026-103349 Auth required
Rymera Web Co Product Feed PRO for WooCommerce - Insecure Deserialization
Rymera Web Co Product Feed PRO for WooCommerce <= 13.5.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.2 /10 HighCVE-2026-103348 Auth required
Smackcoders Inc. WP Ultimate Exporter - Insecure Deserialization
Smackcoders Inc. WP Ultimate Exporter <= 3.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-103334 No auth
Etoile Web Design Incorporated Five Star Restaurant Reservations - Information Disclosure
Etoile Web Design Incorporated Five Star Restaurant Reservations <= 2.7.24 contains an insertion of sensitive information into sent data vulnerability, letting attackers retrieve embedded sensitive data, exploit requires crafted input.
- 8.5 /10 HighCVE-2026-103066 Auth required
WP BASE Booking - SQL Injection
WP BASE Booking <= 6.4.0 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-102775 No auth
Phoca Cart - Authorization Bypass
Phoca Cart 5.0.0 - 6.1.8 contains an authorization bypass caused by lack of proper verification of download tokens in the order-file download endpoint, letting remote attackers download any customer's digital goods by supplying arbitrary tokens, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-102282 PoC publicAuth required
adm-zip - Privilege Escalation
adm-zip < 0.6.1 contains a privilege escalation caused by applying unfiltered Unix permission bits including setuid/setgid during extraction with keepOriginalPermission=true, letting attackers gain root execution via crafted zip, exploit requires extraction as root.
- 7.3 /10 HighCVE-2026-102262 PoC publicAuth required
Newell Brands DYMO ID - Remote Code Execution
Newell Brands DYMO ID 1.5.1.71 contains a code execution vulnerability caused by resolving plugin Modules directory relative to the process working directory, letting attackers execute code at victim's privilege level when a malicious job file is opened.
- 8.8 /10 HighCVE-2026-101919 Auth required
HyperShift Operator - Remote Code Execution
HyperShift operator contains a remote code execution caused by copying user-provided kubeconfig secrets without validation into privileged control plane namespace, letting authenticated users with cluster and secret creation permissions execute arbitrary code, exploit requires cluster and secret creation permissions.