High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 292 of 628

  • 7.4 /10 High
    CVE-2026-105216 No auth

    go-micro - Man-in-the-Middle

    go-micro < 6.0.0 contains a man-in-the-middle vulnerability caused by improper certificate validation with InsecureSkipVerify set to true by default, letting network attackers intercept or modify service traffic, exploit requires network access.

  • 8.2 /10 High
    CVE-2026-105213 No auth

    ZITADEL - Authentication Bypass

    ZITADEL < 4.17.1 contains a broken authentication caused by not checking an organization's inactive state during Login V2, letting users of deactivated organizations sign in and obtain tokens, exploit requires valid user credentials or session.

  • 7.5 /10 High
    CVE-2026-105212 No auth

    ZITADEL - Authentication Bypass

    ZITADEL 3.x < 3.4.14 and 4.x < 4.16.2 contain an authentication bypass caused by acceptance of passkey or authenticator enrollment on identify-only login sessions before primary factor verification, letting unauthenticated attackers log in as users, exploit requires knowledge of victim's login name.

  • 8.1 /10 High
    CVE-2026-105211 No auth

    ZITADEL - Authentication Bypass

    ZITADEL < 4.17.1 contains an authentication bypass caused by OTP code exposure via returnCode delivery type in Login V2, letting unauthenticated attackers take over accounts including administrators, exploit requires victim to have OTP-Email and OTP-SMS enrolled.

  • 8.2 /10 High
    CVE-2026-105210 No auth

    ZITADEL - Authentication Bypass

    ZITADEL 3.x < 3.4.15 and 4.x < 4.17.1 contain a broken authentication caused by missing primary factor verification in hosted Login V1 UI second-factor enrollment, letting attackers enroll factors and enumerate users knowing only login names.

  • 7.7 /10 High
    CVE-2026-105208 Auth required

    ZITADEL - Broken Access Control

    ZITADEL 4.x < 4.17.3 and 3.x <= 3.4.15 contain a broken access control vulnerability caused by unauthenticated, malleable encryption of IdP intent tokens, letting authenticated users tamper tokens to hijack other users' external login intents, exploit requires predicting victim's intent identifier and winning a timing race.

  • 7.3 /10 High
    CVE-2026-105167 No auth

    kishor-23 food-waste-management-system - SQL Injection

    kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of the "location" argument in admin/donate.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105166 No auth

    kishor-23 food-waste-management-system - SQL Injection

    kishor-23 food-waste-management-system contains a sql injection caused by manipulation of the "image-choice" argument in the insert function of Food Donation Form component, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-105158 No auth

    RainyGao DocSys - SQL Injection

    RainyGao DocSys <= 2.02.85 contains a sql injection caused by manipulation of the "url" argument in BaseController.createDBForMysql in Database Management, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105149 No auth

    mooSocial - SQL Injection

    mooSocial <= 3.2.4 contains a sql injection caused by manipulation of the "rating" argument in /stores/all-products, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105148 No auth

    SciPhi-AI R2R - Server-Side Request Forgery

    SciPhi-AI R2R <= 3.6.6 contains a server-side request forgery caused by manipulation of the argument generation_config.api_base in Retrieval Completion API Endpoint, letting remote attackers make arbitrary requests, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-105147 No auth

    SciPhi-AI R2R - Hardcoded Credentials

    SciPhi-AI R2R <= 3.6.6 contains a hardcoded credentials vulnerability caused by manipulation of DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY in JWT Secret Handler, letting remote attackers exploit hardcoded secrets.

  • 7.3 /10 High
    CVE-2026-105133 CISA KEVPoC publicNo auth

    Ahsay AhsayCBS - Authentication Bypass

    Ahsay AhsayCBS <= 10.3.2 contains an authentication bypass caused by manipulation of the "random" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.

  • 7.2 /10 High
    CVE-2026-105126 Auth required

    LaraDashboard - Broken Access Control

    LaraDashboard < 1.4.8 contains a broken access control vulnerability caused by improper privilege management in role editing, letting authenticated admin users escalate to superadmin and execute code, exploit requires admin privileges.

  • 8.8 /10 High
    CVE-2026-105123 Auth required

    W (vincent-peugnet/wcms) - Remote Code Execution

    W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution caused by unvalidated path in POST /api/v0/media/upload/[*:path], letting authenticated editors write arbitrary files including executable PHP, exploit requires authenticated editor privileges.