High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 343 of 568
- 7.4 /10 HighCVE-2026-77246 PoC publicNo auth
MCP Atlassian - Authorization Bypass
MCP Atlassian < 0.22.0 contains an authorization bypass caused by accepting requests without identity and allowing attacker-controlled service headers, letting attackers upload server-local files to attachment endpoints, exploit requires READ_ONLY_MODE=false.
- 8.8 /10 HighCVE-2026-77243 PoC public
MCP Atlassian - Broken Access Control
MCP Atlassian < 0.22.0 contains a broken access control vulnerability caused by improper rechecking of ENABLED_TOOLS and TOOLSETS during tools/call requests, letting clients invoke excluded read, write, or delete tools despite least-privilege restrictions, exploit requires knowledge of hidden tool names.
- 7.5 /10 HighCVE-2026-77242 PoC publicNo auth
MCP Atlassian - Server Side Request Forgery
MCP Atlassian < 0.22.0 contains a server-side request forgery caused by inconsistent DNS resolution in validate_url_for_ssrf and connection libraries, letting unauthenticated attackers access internal or metadata endpoints, exploit requires crafted URL with short-lived DNS.
- 7.1 /10 HighCVE-2026-76715
Analytics and Location Engine - Remote Code Execution
Analytics and Location Engine contains a man-in-the-middle vulnerability in an administrative component, letting unauthenticated remote attackers execute arbitrary code with root privileges, exploit requires network access to the component.
- 7.2 /10 HighCVE-2026-76714 Auth required
Analytics and Location Engine - Command Injection
Analytics and Location Engine web interface contains a command injection caused by vulnerabilities in the web interface, letting remote authenticated users execute arbitrary commands as root, exploit requires authentication.
- 7.2 /10 HighCVE-2026-76713 Auth required
Analytics and Location Engine - Privilege Escalation
Analytics and Location Engine contains a privilege escalation caused by improper access control in maintenance restore functionality, letting authenticated remote attackers gain root file system access, exploit requires authentication.
- 7.3 /10 HighCVE-2026-76712 No auth
Analytics and Location Engine - Information Disclosure & Denial of Service
Analytics and Location Engine contains an information disclosure, security bypass, and denial of service vulnerability caused by improper input handling and network communication interception, letting unauthenticated remote attackers access sensitive information, bypass security controls, or cause denial of service, exploit requires network access.
- 7.5 /10 HighCVE-2026-76711 No auth
Analytics and Location Engine - Data Tampering
Analytics and Location Engine contains a data tampering vulnerability caused by improper processing of incoming socket connections, letting unauthenticated remote attackers inject unauthorized data, exploit requires crafted input during connection.
- 7.5 /10 HighCVE-2026-76710 No auth
Analytics and Location Engine - Information Disclosure
Analytics and Location Engine (ALE) contains an information disclosure vulnerability caused by unauthenticated access to internal endpoints, letting remote attackers disclose sensitive site hierarchy, infrastructure, and client device information, exploit requires no authentication.
- 8.6 /10 HighCVE-2026-75791 No auth
Zohocorp ManageEngine ADSelfService Plus - Authentication Bypass
Zohocorp ManageEngine ADSelfService Plus < 7001 contains an authentication bypass caused by a flaw in the REST API, letting attackers bypass authentication, exploit requires no special privileges.
- 8.1 /10 HighCVE-2026-75744 Auth required
Adobe Experience Manager Forms JEE - Stored XSS
Adobe Experience Manager Forms JEE contains a stored XSS vulnerability caused by improper sanitization of form fields, letting high-privileged attackers inject malicious scripts, exploit requires high privileges.
- 7.1 /10 HighCVE-2026-75743 No auth
Adobe Experience Manager Forms JEE - Cross-Site Request Forgery
Adobe Experience Manager Forms JEE contains a cross-site request forgery caused by insufficient request validation, letting attackers bypass security features and gain unauthorized write access, exploit requires victim interaction with malicious URL or page.
- 7.8 /10 HighCVE-2026-75676 No auth
Bridge - Buffer Overflow
Bridge contains a stack-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 7.8 /10 HighCVE-2026-75665 No auth
Bridge - Remote Code Execution
Bridge contains a heap-based buffer overflow caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 7.8 /10 HighCVE-2026-75663 No auth
Bridge - Remote Code Execution
Bridge contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.