High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 335 of 568
- 8.5 /10 HighCVE-2026-76648
CVE-2026-76648
CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks: can_access(model, 'add', create_kwargs_check) can_access(model, 'copy_related', obj) For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.
- 7.7 /10 HighCVE-2026-76089 Auth required
Formie Craft CMS - Broken Access Control
Formie Craft CMS plugin < 2.2.23 and < 3.1.31 contains an information disclosure vulnerability caused by lack of permission and object-level authorization checks in SentNotificationsController::actionGetResendModalContent, letting authenticated users read recipient headers and email bodies, exploit requires authentication.
- 8.2 /10 HighCVE-2026-76087 No auth
Formie Craft CMS - Broken Access Control
Formie Craft CMS plugin < 2.2.23 and < 3.1.31 contains a broken access control vulnerability caused by trusting client-supplied submissionId without session binding or ownership validation in SubmissionsController::actionSubmit, letting unauthenticated attackers overwrite or hijack incomplete submissions, exploit requires sequential submission IDs.
- 8.5 /10 HighCVE-2026-76086 Auth required
Formie Craft CMS - Server-Side Request Forgery
Formie Craft CMS plugin < 2.2.23 and < 3.1.31 contains a server-side request forgery caused by missing permission checks in form-settings action, letting authenticated attackers with low privileges manipulate integration settings and access internal hosts, exploit requires authenticated low-privileged user.
- 7.3 /10 HighCVE-2026-75973
Apache Tomcat - Authentication Bypass
Apache Tomcat 8.5.0 to 8.5.100, 9.0.0.M4 to 9.0.121, 10.1.0-M1 to 10.1.59, and 11.0.0-M1 to 11.0.25 contain an improper authentication vulnerability caused by shared realm usage with SimpleAuthConfigProvider across multiple web applications, letting attackers bypass authentication, exploit requires multiple web applications using the provider.
- 7.5 /10 HighCVE-2026-75887 No auth
OpenShift console - Path Traversal
OpenShift console contains a path traversal caused by manipulation of 'lng' and 'ns' query parameters in /locales/resource.json endpoint, letting unauthenticated attackers read sensitive JSON files from the pod filesystem.
- 7.2 /10 HighCVE-2026-75886 No auth
openshift/console - Broken Access Control
openshift/console contains an information disclosure vulnerability caused by misconfiguration in CatalogdHandler and forwarding of the openshift-session-token cookie, letting unauthenticated remote attackers access internal operator-catalog index and relay into openshift-catalogd namespace, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-75825
ZohoCorp ManageEngine OpManager - Authentication Bypass
ZohoCorp ManageEngine OpManager <= 12.8.710 with Application Manager Plugin enabled contains an authentication bypass vulnerability, letting attackers bypass authentication, exploit requires Application Manager Plugin enabled.
- 7.8 /10 HighCVE-2026-75131 Auth required
NetworkManager-l2tp - Privilege Escalation
NetworkManager-l2tp <= 1.52.4 contains a privilege escalation caused by injection of pppd options via crafted VPN username, letting local users with VPN creation permission execute arbitrary code as root, exploit requires local VPN creation permission.
- 7.5 /10 HighCVE-2026-73591 No auth
Dell Secure Connect Gateway (SCG) Policy Manager - Information Disclosure
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an inclusion of sensitive information in source code vulnerability, letting unauthenticated remote attackers expose sensitive information, exploit requires remote access.
- 7.4 /10 HighCVE-2026-73588
Dell Secure Connect Gateway Policy Manager - Authentication Bypass
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains a missing authentication for critical function vulnerability, letting unauthenticated remote attackers gain unauthorized access, exploit requires remote access.
- 8.8 /10 High
- 7.8 /10 HighCVE-2026-6935 Auth required
IBM Concert - Command Injection
IBM Concert 1.0.0 through 3.0.0 contains a command injection caused by unqualified executable paths and unrestricted search path resolution, letting local attackers execute malicious code, exploit requires local system access.
- 7.8 /10 HighCVE-2026-6794 Auth required
IBM Concert - Remote Code Execution
IBM Concert 1.0.0 through 3.0.0 contains a double free vulnerability caused by incorrect memory management, letting local attackers execute arbitrary code by corrupting heap memory, exploit requires local access.
- 7.5 /10 HighCVE-2026-6668 No auth
PgBouncer - Denial of Service
PgBouncer through 1.25.2 contains an integer overflow caused by improper packet buffer growth logic, letting unauthenticated remote attackers cause denial of service by saturating CPU and stalling connections, exploit requires crafted large input.