High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 299 of 628
- 7.1 /10 HighCVE-2026-63578 No auth
Legion of the Bouncy Castle Inc. bc-csharp - Denial of Service
Legion of the Bouncy Castle Inc. bc-csharp < 2.7.0 contains a denial of service caused by unbounded iteration count in password-based private-key decryption (PbeUtilities.GenerateCipherParameters), letting attackers cause CPU exhaustion via crafted encrypted private keys, exploit requires supplying a crafted encrypted private key.
- 8.2 /10 HighCVE-2026-63577
Legion of the Bouncy Castle Inc. bc-csharp - Authentication Bypass
Legion of the Bouncy Castle Inc. bc-csharp < 2.7.0 contains an improper certificate validation vulnerability caused by incorrect directoryName name-constraint checks in PkixNameConstraintValidator.WithinDNSubtree, letting attackers with control over name-constrained intermediate CAs bypass PKIX path validation, exploit requires attacker to control or have certificates issued by a name-constrained intermediate CA.
- 8.2 /10 HighCVE-2026-63576 No auth
Legion of the Bouncy Castle Inc. bc-csharp - Authentication Bypass
Legion of the Bouncy Castle Inc. bc-csharp < 2.7.0 contains an improper certificate validation caused by incorrect host extraction in PkixNameConstraintValidator, letting attackers bypass URI name constraints during certification path validation, exploit requires crafted certificates with specific subjectAltName URIs.
- 7.1 /10 HighCVE-2026-61374 Auth required
Apache Thrift - Denial of Service
Apache Thrift Java bindings before 0.25.0 contain an allocation of resources without limits or throttling vulnerability, letting attackers exhaust resources, exploit requires no special privileges.
- 8.7 /10 HighCVE-2026-61373 No auth
Apache Thrift - Denial of Service
Apache Thrift Java TSaslNonblockingServer before 0.25.0 contains an allocation of resources without limits or throttling vulnerability, letting attackers cause denial of service by exhausting resources, exploit requires network access.
- 8.8 /10 HighCVE-2026-59265 PoC publicNo auth
Apache OpenOffice - Remote Code Execution
Apache OpenOffice <= 4.1.16 contains a remote code execution caused by Java integration processing crafted untrusted documents, letting attackers execute arbitrary code when opened by users, exploit requires user to open malicious document.
- 7.3 /10 HighCVE-2026-51917 No auth
FinRobot - Command Injection
FinRobot v1.0.0 contains a command injection caused by improper input handling in CodingUtils.modify_code, letting attackers execute arbitrary code remotely, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-51916 No auth
TransformerOptimus SuperAGI - Broken Access Control
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability caused by missing authentication and ownership verification in delete_user_knowledge in superagi/controllers/knowledges.py, letting attackers delete knowledge objects without authorization, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-51914 Auth required
TransformerOptimus SuperAGI - Broken Access Control
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability caused by lack of verification of agent_id or agent_execution_id ownership in agent_template controller, letting authenticated users access unauthorized agent templates, exploit requires user authentication.
- 8.1 /10 HighCVE-2026-51907 Auth required
TaskingAI - Path Traversal
TaskingAI v0.3.0 contains a path traversal vulnerability caused by manipulation of the project_id parameter in the QR Code Generator plugin's save_base64_image function, letting attackers write image files to arbitrary server locations, exploit requires crafted input.
- 8.1 /10 HighCVE-2026-51901 Auth required
SuperAGI - Broken Access Control
SuperAGI <= 0.0.14 contains an incorrect access control vulnerability caused by lack of authorization checks on the /api/agentexecutions/schedule endpoint, letting authenticated users schedule agents from other organizations.
- 8.8 /10 HighCVE-2026-39718 No auth
Webriti Wallstreet - Cross Site Request Forgery
Webriti Wallstreet <= 2.8.6 contains a cross site request forgery vulnerability caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.
- 8.2 /10 HighCVE-2026-18036
Bouncy Castle - Timing Side-Channel Information Disclosure
Bouncy Castle for Java < 1.86 contains a timing side-channel vulnerability caused by secret-dependent integer division in NTRU polynomial reduction, letting attackers recover private key information via timing analysis, exploit requires precise timing measurement.
- 7.5 /10 HighCVE-2026-17507 No auth
Bouncy Castle - Denial of Service
Bouncy Castle for Java < 1.86 contains a denial of service caused by signed integer misinterpretation of uint32 leaf_index in MLS implementation, letting attackers send crafted messages to exhaust JVM heap, exploit requires membership in group.
- 8.8 /10 HighCVE-2026-15897 Auth required
Super Forms – Drag & Drop Form Builder - Privilege Escalation
Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains a privilege escalation caused by lack of ownership and capability checks in Register & Login add-on's before_email_success_msg() and super_save_form AJAX action, letting authenticated users with Subscriber-level access overwrite credentials of arbitrary accounts including administrators, exploit requires authenticated user with Subscriber-level access or higher.