High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 311 of 628

  • 7.3 /10 High
    CVE-2026-103278 Auth required

    Ghost - Authentication Bypass

    Ghost 5.8.0 < 6.34.0 contains an input validation vulnerability in the admin iframe, letting attackers with content publishing privileges take over staff user accounts, exploit requires crafted malicious pages visited by active staff users.

  • 8.1 /10 High
    CVE-2026-103277 No auth

    Ghost - Stored XSS

    Ghost > 2.5.0 < 6.34.0 contains a stored XSS caused by unsandboxed externally hosted scripts in the oEmbed preview feature, letting attackers execute scripts in staff admin sessions, exploit requires crafted malicious oEmbed content.

  • 7.5 /10 High
    CVE-2026-103272 No auth

    Ghost - Broken Access Control

    Ghost 2.10.0 < 6.63.0 contains a staff enumeration vulnerability caused by discrepancies in content API metadata responses, letting unauthenticated attackers leak user data, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-103271 No auth

    Ghost - Broken Access Control

    Ghost 4.0.0 < 6.63.0 contains an information disclosure vulnerability caused by improper access control in the content API, letting unauthenticated visitors access gated post content, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-103268 Auth required

    Ghost - Authentication Bypass

    Ghost < 6.62.0 contains an authentication bypass caused by allowing suspended staff users to reactivate accounts via self-service password reset, letting suspended staff attackers regain active access and privileges, exploit requires suspended staff credentials.

  • 7.1 /10 High
    CVE-2026-103266 No auth

    Ghost - Cross-Site Scripting

    Ghost 5.2.0 through < 6.62.0 contains a cross-site scripting caused by abuse of Stripe Checkout flow allowing modification of member data and newsletter content, letting remote attackers inject HTML or scripts, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-103262 No auth

    Tornado - Denial of Service

    Tornado < 6.5.9 contains a denial of service vulnerability caused by unbounded memory accumulation in CurlAsyncHTTPClient when processing compressed responses, letting remote attackers cause application crash via decompression bomb, exploit requires sending crafted compressed response.

  • 7.6 /10 High
    CVE-2026-103259

    n8n - Authentication Bypass

    n8n < 2.39.6 and 2.40.0 < 2.40.1 contain a session token leakage caused by fallback resolver manipulation in Dynamic Credentials authorize and revoke endpoints, letting attackers with resolver registration capture collaborators' session tokens, exploit requires resolver registration capability.

  • 7.7 /10 High
    CVE-2026-103257 No auth

    n8n - Path Traversal

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a path traversal caused by improper validation of resource identifiers in the n8n node, letting attackers access unauthorized workflows, executions, and credential secrets, exploit requires crafted resource IDs.

  • 7.1 /10 High
    CVE-2026-103256 Auth required

    n8n - Information Disclosure

    n8n < 2.39.6 and 2.40.0 < 2.40.1 contain a credentials leak caused by sending unencrypted passwords to unvalidated hosts in Wekan and Baserow username-and-password credentials, letting attackers with credential update permissions leak passwords, exploit requires credential update permissions.

  • 8.7 /10 High
    CVE-2026-103253 No auth

    n8n - SQL Injection

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain an SQL injection caused by improper sanitization in Oracle Database node's Delete Table Drop operation, letting attackers execute arbitrary SQL commands with database privileges, exploit requires access to the node.

  • 7.7 /10 High
    CVE-2026-103252 Auth required

    n8n - Authorization Bypass

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain an authorization bypass caused by lack of caller access validation in the credential test endpoint, letting attackers exfiltrate sensitive variables by specifying arbitrary project IDs, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-103251

    n8n - Authentication Bypass & Remote Code Execution

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a validation bypass caused by improper checks in the community package installation handler for queue mode deployments, letting attackers with Redis write access install arbitrary npm packages without authentication.

  • 8.1 /10 High
    CVE-2026-103250 No auth

    n8n - NoSQL Injection

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a NoSQL injection caused by improper validation of the sessionId parameter in the MongoDB Chat Memory node, letting unauthenticated attackers access and modify other users' conversation histories, exploit requires no authentication.

  • 7.6 /10 High
    CVE-2026-103249 Auth required

    n8n - Stored XSS

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a stored XSS caused by improper sanitization of Resource Locator parameter dropdown link, letting workflow authors execute arbitrary JavaScript in editor origin when other users interact with the node dropdown, exploit requires other users to open the node dropdown and click the external-link icon.