High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 323 of 568
- 8.6 /10 HighCVE-2026-77874 No auth
IBM Enterprise Build of Quarkus - SQL Injection
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 contains a SQL injection caused by improper sanitization of SQL statements, letting remote unauthenticated attackers view, add, modify, or delete database information, exploit requires crafted SQL statements.
- 8.6 /10 HighCVE-2026-77581 No auth
BentoPDF - Server Side Request Forgery
BentoPDF <= 2.8.6 contains a server-side request forgery caused by improper hostname validation in cloudflare/cors-proxy-worker.js, letting attackers make requests to internal or reserved destinations, exploit requires reachable internal network.
- 8.1 /10 HighCVE-2026-77294 Auth required
TREK - Server Side Request Forgery
TREK < 3.3.0 contains a server-side request forgery vulnerability caused by lack of SSRF guard in AI-assisted import path when LLM_PARSING feature is enabled, letting authenticated users with write permission to a trip instance access internal services and cloud metadata, exploit requires write permission on target trip instance.
- 7.1 /10 HighCVE-2026-77293 Auth required
TREK - Broken Access Control
TREK < 3.3.0 contains a broken access control vulnerability caused by improper authorization checks in DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint, letting authenticated users with edit access delete note-file attachments from other users' trips, exploit requires user to have edit access to any trip.
- 7.5 /10 HighCVE-2026-77193 No auth
eesy_ID2WP – Publish InDesign HTML5 WordPress plugin - Path Traversal
eesy_ID2WP – Publish InDesign HTML5 WordPress plugin <= 1.0.3 contains a path traversal caused by improper sanitization of the `id2wp_path` parameter, letting unauthenticated attackers read arbitrary files on the server.
- 7.5 /10 HighCVE-2026-75907
Norwegian Cruise Line Door Access - Authentication Bypass
Norwegian Cruise Line door access control uses static 7-byte UID on NTAG212 NFC chips for identification, lacking challenge-response authentication, letting attackers clone credentials to gain unauthorized access, exploit requires physical access to credential.
- 7.5 /10 HighCVE-2026-71540 No auth
Wazuh - Denial of Service
Wazuh 3.9.0 to 4.14.7 contains a denial of service caused by unvalidated large payload allocation in wazuh-clusterd before Fernet decryption, letting unauthenticated network peers exhaust memory, exploit requires network access.
- 7.5 /10 HighCVE-2026-63645 No auth
OpenObserve - Information Disclosure
OpenObserve < 0.90.3 contains an information disclosure caused by unauthenticated access to /config/runtime endpoint that exposes sensitive configuration fields, letting unauthenticated network clients access database credentials and internal deployment details.
- 8.7 /10 HighCVE-2026-63498 PoC publicAuth required
Snipe-IT - Stored XSS
Snipe-IT < 8.7.0 contains a stored XSS caused by lack of safe-inline allowlist in the uploaded-files API endpoint, letting authenticated users execute JavaScript in victim's browser, exploit requires victim to open malicious attachment URL.
- 8.1 /10 HighCVE-2026-63493 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT < 8.7.0 contains a broken access control vulnerability caused by missing two-factor enforcement in API middleware, letting authenticated attackers with self.api permission bypass 2FA and gain persistent API access, exploit requires password-authenticated session.
- 7.6 /10 HighCVE-2026-63203 Auth required
Logto - Broken Access Control
Logto 1.31.0 to 1.42.0 contains an information disclosure vulnerability caused by missing scope validation in Account API handlers, letting attackers with same-user openid tokens retrieve stored SSO provider access tokens, exploit requires federated token-set storage enabled and user authenticated via supported connector.
- 8.1 /10 HighCVE-2026-62368 PoC publicAuth required
Snipe-IT - Stored XSS
Snipe-IT < 8.7.0 contains a stored XSS caused by unescaped markup in CustomField.name used in asset-list page headers, letting authenticated users execute scripts, potentially escalating privileges if viewed by superusers.
- 8.7 /10 HighCVE-2026-61825 Auth required
code16 Sharp - Stored XSS
code16 Sharp < 9.22.5 contains a stored cross-site scripting caused by improper sanitization of data-html-content attribute in SharpEditorFormField, letting attackers execute scripts when other users view stored content, exploit requires stored malicious content.
- 7.3 /10 HighCVE-2026-61823 Auth required
code16 Sharp - Stored XSS
code16 Sharp < 9.22.5 contains a stored cross-site scripting vulnerability caused by permitting the srcdoc attribute on iframe elements in the rich-text editor, letting authenticated users with Editor field permission execute JavaScript when content is viewed.
- 7.5 /10 HighCVE-2026-61816 No auth
zbateson/mail-mime-parser - Denial of Service
zbateson/mail-mime-parser >= 2.0.0 and < 3.0.6 or < 4.0.2 contains an uncontrolled resource consumption vulnerability caused by super-linear parsing paths in multipart and header processing, letting attackers cause denial of service by sending crafted emails, exploit requires parsing untrusted email input.