High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 300 of 628

  • 7.1 /10 High
    CVE-2026-105050

    PeaZip - Command Injection

    PeaZip < 11.3.0 contains a command injection caused by mishandling of quotation characters in filenames within archives, letting attackers execute OS commands, exploit requires non-default configuration.

  • 7.1 /10 High
    CVE-2026-104991 PoC publicAuth required

    Phproject - Broken Access Control

    Phproject before 1.8.7 contains a broken access control vulnerability in REST API issue endpoints caused by missing object-level authorization, letting authenticated API key holders read restricted issue data and post unauthorized comments, exploit requires valid API key.

  • 8.1 /10 High
    CVE-2026-104988 Auth required

    Dogtag PKI - Authentication Bypass

    Dogtag PKI pki-core contains a broken authentication caused by CMCAuthForEST plugin failing open on EST fullcmc enrollment requests without end-user TLS client certificate, letting authenticated EST users obtain CA-signed certificates with arbitrary subject names, exploit requires authentication.

  • 7.1 /10 High
    CVE-2026-104912 Auth required

    MISP - Broken Access Control

    MISP prior to v2.5.48 contains an authorization flaw caused by stale distribution snapshots in correlation handling during attribute searches, letting authenticated users access restricted event attributes and metadata.

  • 7.6 /10 High
    CVE-2026-104873 Auth required

    LangGraph Python SDK - Broken Access Control

    LangGraph Python SDK 0.1.45 to 0.4.4 contains a broken access control caused by resource-scoped authorization decorators ignoring the actions argument, letting authenticated users bypass permission checks to access others' resources, exploit requires use of affected decorators with actions.

  • 7.5 /10 High
    CVE-2026-104861 No auth

    probe-image-size - Denial of Service

    probe-image-size < 7.4.0 contains a denial of service caused by inefficient regex scanning in SVG parsers, letting attackers block the Node.js event loop with crafted input, exploit requires attacker-controlled input.

  • 7.3 /10 High
    CVE-2026-104859 No auth

    Nx - Command Injection

    Nx 21.4.0 to 22.7.8 and 23.0.0 to 23.1.1 contains a command injection caused by untrusted interpolation of release.docker.repositoryName and registryUrl in shell command strings, letting attackers execute commands with release job privileges, exploit requires attacker to control Nx configuration.

  • 8.5 /10 High
    CVE-2026-104854

    Nx - Remote Code Execution

    Nx 14.6.0 to 22.7.9 and 23.1.2 contains a code execution vulnerability caused by insecure Unix domain socket permissions in daemon and plugin workers, letting unprivileged local attackers execute code as the Nx user, exploit requires local access to the system.

  • 8.8 /10 High
    CVE-2026-104851 No auth

    fsspec - Template Injection

    fsspec 0.9.0 to 2026.6.0 contains a template injection caused by unrestricted jinja2.Template rendering in ReferenceFileSystem, letting attackers execute arbitrary Python code when opening crafted reference JSON documents, exploit requires attacker-controlled document input.

  • 7.5 /10 High
    CVE-2026-104845 No auth

    Seroval - Denial of Service

    Seroval before 1.6.3 contains a denial of service caused by unbounded allocation in deserializeTypedArray in fromJSON and fromCrossJSON trusting untrusted source values, letting attackers exhaust CPU or memory, exploit requires crafted JSON input.

  • 7.3 /10 High
    CVE-2026-104637 No auth

    onetwothreeneth HospitalManagementSystem - Unrestricted File Upload

    onetwothreeneth HospitalManagementSystem contains an unrestricted file upload vulnerability caused by improper validation of the "img" argument in php/controller.php functions, letting remote attackers upload arbitrary files, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-104609 No auth

    onetwothreeneth HospitalManagementSystem - SQL Injection

    onetwothreeneth HospitalManagementSystem contains a SQL injection caused by manipulation of user_id, patient_id, physician_id, discounts_id, or services_id arguments in edit_accounts.php get function, letting remote attackers execute arbitrary SQL queries, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-104472 No auth

    YesWiki - Broken Access Control

    YesWiki < 4.6.7 contains a broken access control caused by missing authorization in the attachment download handler, letting unauthenticated attackers bypass page read ACLs to download confidential attachments.

  • 7.2 /10 High
    CVE-2026-104471 Auth required

    YesWiki - Unrestricted File Upload

    YesWiki < 4.6.7 contains an unrestricted file upload vulnerability caused by lack of extension checks in Bazar CSV import preview, letting authenticated admins upload and execute remote PHP files, exploit requires admin authentication.

  • 8.1 /10 High
    CVE-2026-104467 No auth

    YesWiki - Authorization Bypass

    YesWiki < 4.6.7 contains an authorization bypass caused by improper checks in ApiService::isAuthorized() when public API mode is enabled, letting unauthenticated attackers call admin-only API routes and modify configurations or backups, exploit requires public API mode enabled.