High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 334 of 568
- 8.8 /10 HighCVE-2026-80412 Auth required
IBM DataStage - Command Injection
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper escaping of connector property values during OSH script generation, letting remote authenticated attackers execute arbitrary code.
- 8.8 /10 HighCVE-2026-80379 Auth required
IBM DataStage - Command Injection
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.
- 7.5 /10 HighCVE-2026-79677 No auth
Apache Tomcat - Denial of Service
Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 contain a denial of service caused by missing resource release and incorrect timeout comparison in asynchronous WebSocket writes, letting attackers cause service disruption, exploit requires network access.
- 8.5 /10 HighCVE-2026-79310
webpy web.py - Server-Side Template Injection
webpy web.py 0.76 contains a server-side template injection caused by sandbox bypass in precompiled template loader, letting attackers execute arbitrary Python code and OS commands remotely, exploit requires attacker to write to template directory.
- 7.3 /10 HighCVE-2026-78437
Apache Tomcat - Denial of Service
Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121 contain an incomplete cleanup vulnerability caused by malformed requests, letting attackers cause requests from other users to fail, exploit requires timing conditions.
- 7.5 /10 HighCVE-2026-78383 No auth
Apache Tomcat - Denial of Service
Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 contain a denial of service caused by allocation of resources without limits in AJP processing threads, letting unauthenticated attackers pin threads and exhaust resources, exploit requires unauthenticated AJP request.
- 7.5 /10 HighCVE-2026-77791 No auth
Apache Tomcat - Denial of Service
Apache Tomcat 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, and 9.0.74 through 9.0.121 contain a denial of service caused by uncontrolled resource consumption during WebSocket close message handling, letting attackers cause service disruption, exploit requires network access.
- 8.1 /10 HighCVE-2026-77762 No auth
Apache Tomcat - Race Condition
Apache Tomcat 8.5.59 through 8.5.100, 9.0.39 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25 contain a race condition caused by improper synchronization in HTTP/2 request handling, letting attackers inject trailer fields into other HTTP/2 requests, exploit requires crafted HTTP/2 requests.
- 8.8 /10 HighCVE-2026-77601 Auth required
OpenC3 COSMOS - Command Injection
OpenC3 COSMOS 5.12.0 to 7.3.0 contains a command injection caused by unsanitized pypi_url setting interpolation in shell commands during plugin installation, letting authenticated actors execute arbitrary OS commands as the openc3 service user, exploit requires authentication.
- 7.5 /10 HighCVE-2026-77423 No auth
JLine - Denial of Service
JLine 3.0.0 to 3.30.15 and 4.3.1 contain a denial of service caused by user-controlled nested-quantifier regex patterns in the built-in less viewer, letting attackers cause excessive CPU usage and session blocking, exploit requires sending crafted patterns.
- 7.5 /10 HighCVE-2026-77422
JLine - Denial of Service
JLine 3.0.0 to 3.30.15 and 4.3.1 contain a denial of service caused by excessive backtracking in user-controlled regular expressions in the built-in grep command, letting remote attackers cause CPU exhaustion, exploit requires remote shell access.
- 7.6 /10 HighCVE-2026-77394 Auth required
OpenC3 COSMOS - Stored XSS
OpenC3 COSMOS 5.0.6 to 7.3.0 contains a stored XSS caused by evaluation of BUTTON widget action in shared screens, letting authenticated actors with system_set permission steal tokens and take over accounts, exploit requires system_set permission.
- 7.4 /10 HighCVE-2026-76980 No auth
ZohoCorp ManageEngine OpManager & Firewall Analyzer - Information Disclosure
ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.709 contain a data exposure vulnerability caused by improper handling in the Firewall Analyzer syslog collector, letting attackers access sensitive data, exploit requires network access.
- 7.7 /10 HighCVE-2026-76979 Auth required
ZohoCorp ManageEngine OpManager & Firewall Analyzer - XML External Entity Injection
ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.709 contain an xml external entity injection caused by improper input handling in the Rule Tracking Compare Policies feature, letting attackers perform XML injection remotely, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-76978 Auth required
ZohoCorp ManageEngine OpManager & Firewall Analyzer - Command Injection
ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.709 contain a command injection caused by improper input handling in the Diagnose Settings feature, letting attackers execute arbitrary commands remotely, exploit requires network access.