High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 342 of 568
- 7.5 /10 HighCVE-2026-77558 No auth
UniFi Gateway - Denial of Service
UniFi gateway devices contain an out-of-bounds read vulnerability that allows a network attacker to cause denial of service by crashing the device, exploit requires network access.
- 7.5 /10 HighCVE-2026-77556 No auth
UniFi Gateway - Denial of Service
UniFi gateway devices contain an out-of-bounds read vulnerability that allows a network attacker to cause denial of service by crashing the device, exploit requires network access.
- 7.5 /10 HighCVE-2026-77555 No auth
UniFi Gateway - Denial of Service
UniFi gateway devices contain an out-of-bounds write vulnerability that allows a network attacker to cause denial of service, exploit requires network access.
- 7.5 /10 HighCVE-2026-77544 No auth
UniFi Gateway - Denial of Service
UniFi gateway devices contain an out-of-bounds write vulnerability that allows a network attacker to cause denial of service, exploit requires network access.
- 7.5 /10 HighCVE-2026-77322 No auth
SIPGO - Denial of Service
SIPGO < 1.4.3 contains a denial of service caused by missing MaxFrameSize in WSConnection.Read leading to oversized allocation or panic in wsutil.Reader, letting unauthenticated WS/WSS peers crash or exhaust server memory, exploit requires unauthenticated network access.
- 8.2 /10 HighCVE-2026-77274 PoC publicNo auth
MCP Atlassian - Server Side Request Forgery
MCP Atlassian < 0.22.0 contains a server-side request forgery caused by backslash authority confusion in validate_url_for_ssrf during header-based Jira and Confluence URL authentication, letting attackers access protected internal network resources, exploit requires crafted URL.
- 8.8 /10 HighCVE-2026-77271 PoC public
MCP Atlassian - Code Injection
MCP Atlassian < 0.22.0 contains a code injection vulnerability caused by insecure default base directory in validate_safe_path allowing attacker-selected writes in working directory, letting attackers achieve code execution when the application imports the modified module, exploit requires ability to write files in working directory.
- 8.6 /10 HighCVE-2026-77262 PoC publicNo auth
MCP Atlassian - Path Traversal
MCP Atlassian < 0.22.0 contains a path traversal caused by lack of path restriction in confluence_upload_attachment file_path, letting attackers upload arbitrary server-readable files to Confluence, exploit requires attacker control of file_path.
- 7.1 /10 HighCVE-2026-77261 PoC public
MCP Atlassian - Server Side Request Forgery
MCP Atlassian < 0.22.0 contains a server side request forgery caused by omission of _make_ssrf_safe_hook in JiraFetcher and ConfluenceFetcher sessions, letting attackers follow redirects to internal addresses without revalidation, exploit requires attacker-controlled or compromised Atlassian instance.
- 7.5 /10 HighCVE-2026-77260 PoC publicNo auth
MCP Atlassian - Information Disclosure
MCP Atlassian < 0.22.0 contains an information disclosure caused by unconstrained file_path handling in upload_attachment, letting permitted MCP callers upload and retrieve sensitive host files, exploit requires MCP caller permissions.
- 7.7 /10 HighCVE-2026-77259 PoC publicAuth required
MCP Atlassian - Path Traversal
MCP Atlassian < 0.22.0 contains a path traversal caused by lack of path validation in confluence_upload_attachment, letting attackers upload and read arbitrary server-local files, exploit requires attacker to control file path input.
- 7.7 /10 HighCVE-2026-77258 PoC publicAuth required
MCP Atlassian - Path Traversal
MCP Atlassian < 0.22.0 contains a path traversal caused by caller-controlled file_path in upload_attachment, letting permitted Confluence MCP callers disclose server-local files, exploit requires MCP caller permissions.
- 8.6 /10 HighCVE-2026-77255 PoC publicNo auth
MCP Atlassian - Path Traversal
MCP Atlassian < 0.22.0 contains a path traversal caused by lack of workspace validation in the attachments argument of jira update_issue, letting attackers read arbitrary local files and attach them to Jira issues, exploit requires crafted attachments argument.
- 7.1 /10 HighCVE-2026-77253 PoC publicAuth required
MCP Atlassian - Path Traversal
MCP Atlassian < 0.22.0 contains a path traversal caused by accepting arbitrary local filesystem paths in attachment upload tools, letting remote attackers disclose sensitive files across client-server boundary, exploit requires network access.
- 8.6 /10 HighCVE-2026-77248 No auth
MCP Atlassian - Broken Access Control
MCP Atlassian < 0.22.0 contains a broken access control caused by accepting requests without user identity and unrestricted file_path in upload_attachment, letting unauthenticated attackers read and upload files to Jira or Confluence, exploit requires network access without authentication.