High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 327 of 568
- 7.1 /10 HighCVE-2026-96271 Auth required
Photoview - Authorization Bypass
Photoview 2.4.0 contains an authorization bypass caused by improper access control in the shareAlbum GraphQL mutation, letting authenticated users create share links for albums owned by others, exploit requires user authentication.
- 7.3 /10 HighCVE-2026-95927 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "test_id" argument in /reviewer_0/admins/assessments/pretest/exam-delete.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-95926 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "test_id" argument in /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-95925 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "difficulty_id" argument in /reviewer_0/admins/assessments/databank/btn_functions.php?action=update, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-95924 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "difficulty_id" argument in /reviewer_0/admins/assessments/databank/btn_functions.php?action=add, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-95847 PoC publicNo auth
Moquette - Broken Access Control
Moquette < 0.18.1 contains a data tampering vulnerability caused by client ID naming collisions in H2PersistentQueue message and metadata maps, letting attackers cause message loss, misdelivery, or data exposure, exploit requires client ID ending with _meta.
- 7.5 /10 HighCVE-2026-95846 PoC publicNo auth
Moquette - Broken Access Control
Moquette < 0.18.1 contains a broken access control vulnerability caused by PostOffice.publishWill publishing Last-Will messages without authorization checks, letting attackers inject unauthorized messages on restricted topics, exploit requires client to configure a Will.
- 7.5 /10 HighCVE-2026-95845 PoC publicNo auth
Moquette - Denial of Service
Moquette < 0.18.1 contains a denial of service caused by unbounded accumulation of pending per-session message queues when a fast publisher sends messages to a slow subscriber, letting remote attackers exhaust broker resources, exploit requires network access.
- 7.5 /10 HighCVE-2026-95844 PoC publicNo auth
Moquette - Denial of Service
Moquette < 0.18.1 contains a denial of service caused by unbounded topic name depth in recursive CTrie operations, letting remote clients cause StackOverflowError and disrupt session processing, exploit requires network access.
- 7.5 /10 HighCVE-2026-95843 PoC publicNo auth
Moquette - Denial of Service
Moquette < 0.18.1 contains a denial of service caused by improper parsing of shared-subscription filters in PostOffice.subscribe, letting remote clients cause exceptions that terminate shared session event loops, exploit requires crafted subscription filter.
- 7.5 /10 HighCVE-2026-95842 PoC publicNo auth
Moquette - Denial of Service
Moquette < 0.18.1 contains a denial of service caused by uncaught exceptions terminating shared event loops, letting attackers disrupt session processing for multiple clients, exploit requires attacker to select client IDs mapping to loops.
- 7.5 /10 HighCVE-2026-95676
WatchGuard AuthPoint Gateway - Authentication Bypass
WatchGuard AuthPoint Gateway contains an authentication bypass caused by missing or improper authentication in LDAP Sync first-factor authentication, letting remote attackers bypass single-factor password verification under non-default conditions, exploit requires non-default configuration.
- 7.7 /10 HighCVE-2026-95627 Auth required
Tauri dialog plugin - Stored XSS
Tauri dialog plugin contains a stored XSS caused by JavaScript execution allowing recursive scope expansion in file/folder picker, letting attackers gain persistent read/write access to entire directory trees after user interaction.
- 8.3 /10 HighCVE-2026-95626 No auth
Tauri - Content Security Policy Bypass
Tauri contains a Content Security Policy bypass caused by inclusion of data: or blob: schemes in script-src directive, letting attackers execute arbitrary scripts without knowing the nonce, exploit requires application to include these schemes.
- 7.5 /10 HighCVE-2026-95604 No auth
Loops & Logic - Broken Access Control
Loops & Logic <= 4.2.4 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources without authorization, exploit requires no authentication.