High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 332 of 568
- 7.5 /10 HighCVE-2026-87022 No auth
Apache Tomcat - Server Side Request Forgery
Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 contain a server side request forgery caused by improper handling of length parameter inconsistency in WebSocket per-message-deflate, letting attackers perform WebSocket message smuggling, exploit requires use of per-message-deflate.
- 7.3 /10 HighCVE-2026-86938 Auth required
FileMaker Pro - DLL Hijacking
FileMaker Pro installer for Windows contains a DLL hijacking vulnerability caused by loading malicious DLLs from the installer directory, letting local attackers execute arbitrary code with administrator privileges, exploit requires local access.
- 7.8 /10 HighCVE-2026-86926 No auth
FileMaker Server - Remote Code Execution
FileMaker Server contains a heap buffer overflow caused by improper parsing in the database engine block routine, letting attackers execute arbitrary code via crafted .fmp12 files, exploit requires crafted database file.
- 8.1 /10 HighCVE-2026-86683 Auth required
ZohoCorp ManageEngine Applications Manager - Broken Access Control
ZohoCorp ManageEngine Applications Manager <= 182000 contains a broken access control vulnerability caused by allowing low-privileged users to change proxy settings, letting attackers modify configuration, exploit requires low-privileged user access.
- 7.6 /10 HighCVE-2026-86681 Auth required
ZohoCorp ManageEngine Applications Manager - Broken Access Control
ZohoCorp ManageEngine Applications Manager <= 182200 contains a broken access control caused by improper permissions validation, letting low-privileged users execute administrator-configured MBean actions outside their scope, exploit requires low-privileged user access.
- 7.1 /10 HighCVE-2026-86679 Auth required
ZohoCorp ManageEngine Applications Manager - Broken Access Control
ZohoCorp ManageEngine Applications Manager <= 182000 contains a broken access control caused by improper permissions validation, letting low-privileged users delete service monitors outside their scope, exploit requires low-privileged user access.
- 8.8 /10 HighCVE-2026-86678 Auth required
ZohoCorp ManageEngine Applications Manager - Broken Access Control
ZohoCorp ManageEngine Applications Manager <= 182000 contains a broken access control vulnerability caused by low-privileged users obtaining administrator API keys, letting attackers perform administrator-level actions, exploit requires low-privileged user access.
- 8.8 /10 HighCVE-2026-86677 Auth required
ZohoCorp ManageEngine Applications Manager - SQL Injection
ZohoCorp ManageEngine Applications Manager <= 182000 contains a SQL injection caused by insufficient input validation, letting low-privileged users execute unauthorized SQL commands, potentially gaining administrator access and remote code execution, exploit requires low-privileged user access.
- 8.2 /10 HighCVE-2026-86608 No auth
WP Recipe Maker - Broken Access Control
WP Recipe Maker WordPress plugin < 10.8.2 contains a broken access control vulnerability caused by missing authorization checks in a REST route, letting unauthenticated attackers write unlimited data to any user's metadata, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-86583 Auth required
WordPress Import and export users and customers - Privilege Escalation
WordPress Import and export users and customers plugin <= 2.4.17 contains a privilege escalation caused by CSV escape character mismatch in export/import workflow, letting authenticated attackers with Subscriber-level access escalate to Administrator, exploit requires site administrator to trigger export re-import with specific options.
- 7.4 /10 HighCVE-2026-86247
Apache Tomcat Native - Authentication Bypass
Apache Tomcat Native 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 contain a race condition caused by thread handling in client certificate verification, letting attackers downgrade verification requirements, exploit requires specific configuration.
- 7.5 /10 HighCVE-2026-86243 No auth
Apache Tomcat Native - Denial of Service
Apache Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 contain a buffer over-read vulnerability during the TLS handshake, letting malicious users cause a JVM crash and denial of service, exploit requires network access.
- 7.5 /10 HighCVE-2026-86065 No auth
Klever-Go - Denial of Service
Klever-Go < 1.7.20 contains a denial of service caused by unauthenticated WebSocket clients with unbounded message size and subscription growth in the /subscribe endpoint, letting attackers exhaust memory and crash the node, exploit requires network access.
- 8.6 /10 HighCVE-2026-86064 No auth
Klever-Go - Broken Access Control
Klever-Go < 1.7.20 contains a broken access control vulnerability caused by unauthenticated access to the default-open GET /log WebSocket route, letting remote attackers change global log levels and access operational logs, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-85475 Auth required
Ansible Automation Platform - Command Injection
Ansible Automation Platform automation controller contains a command injection caused by unsanitized interpolation of user-controlled logging settings into rsyslog RainerScript config, letting privileged users execute arbitrary commands, exploit requires superuser privileges.