High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 347 of 568
- 7.9 /10 HighCVE-2026-18066 Auth required
IBM Financial Transaction Manager (FTM) - Server Side Request Forgery
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a server-side request forgery caused by improper validation of server requests, letting local attackers obtain sensitive information and trigger unauthorized actions, exploit requires local access.
- 8.8 /10 HighCVE-2026-17647 Auth required
IBM Financial Transaction Manager (FTM) - Command Injection
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a command injection caused by inclusion of functionality from an untrusted control sphere, letting local attackers execute arbitrary commands, exploit requires local access.
- 8.5 /10 HighCVE-2026-17646 Auth required
IBM Financial Transaction Manager (FTM) - XML External Entity Injection
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an XML external entity injection caused by improper restriction of XML external entity references, letting remote authenticated attackers obtain sensitive information.
- 8.8 /10 HighCVE-2026-17644 Auth required
IBM Financial Transaction Manager - Hardcoded Credentials
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a hardcoded credentials vulnerability caused by embedded static credentials, letting local attackers gain unauthorized access and modify transaction data, exploit requires local access.
- 8.8 /10 HighCVE-2026-17643 Auth required
IBM Financial Transaction Manager - Authentication Bypass
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken authentication caused by insufficiently protected credentials, letting local attackers obtain sensitive information and perform unauthorized actions, exploit requires local access.
- 8.8 /10 HighCVE-2026-17637
IBM Financial Transaction Manager - Remote Code Execution
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting adjacent-network attackers execute arbitrary code remotely, exploit requires network adjacency.
- 8.8 /10 HighCVE-2026-17636 Auth required
IBM Financial Transaction Manager (FTM) - Remote Code Execution
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a remote code execution caused by improper validation of a specified quantity, letting remote authenticated attackers execute arbitrary code.
- 7.3 /10 HighCVE-2026-17618 No auth
IBM Financial Transaction Manager - Broken Access Control
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an improper authorization vulnerability, letting remote unauthenticated attackers view and modify sensitive information and cause denial of service, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-17102 Auth required
IBM DataStage - Command Injection
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.
- 8.8 /10 HighCVE-2026-16672 Auth required
IBM DataStage - Command Injection
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.
- 8.8 /10 HighCVE-2026-16469 Auth required
IBM DataStage on Cloud Pak for Data - Command Injection
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.
- 8.8 /10 HighCVE-2026-16468 Auth required
IBM DataStage - Command Injection
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper input handling, letting remote authenticated attackers execute arbitrary OS commands.
- 7.2 /10 HighCVE-2026-12470 Auth required
NiteoThemes CMP – Coming Soon & Maintenance Plugin - Broken Access Control
NiteoThemes CMP – Coming Soon & Maintenance Plugin for WordPress <= 4.1.17 contains a broken access control vulnerability caused by missing capability check on 'cmp_ajax_import_settings' AJAX action, letting authenticated attackers with Editor-level access escalate privileges by modifying arbitrary options.
- 8.8 /10 HighCVE-2025-1281 Auth required
BM Content Builder WordPress plugin - Arbitrary File Deletion
BM Content Builder WordPress plugin < 3.17.1 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions, letting authenticated attackers with Subscriber-level access delete arbitrary files on the server, exploit requires authenticated Subscriber-level access or higher.
- 7.5 /10 HighCVE-2026-94627 No auth
vLLM Mooncake connector - Denial of Service
vLLM Mooncake connector through 0.29.0 contains a denial of service caused by improper GPU KV cache block ownership management in concurrent child requests, letting attackers exhaust GPU memory, exploit requires concurrent child requests sharing a transfer ID.