High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 35 of 552
- 8.2 /10 HighCVE-2026-101896 No auth
Angular - Denial of Service
Angular < 20.3.32, 21.2.24, and 22.2.0 contains a denial of service caused by numeric matrix and outlet parameters in URL parser leading to excessive heap consumption during server-side rendering, letting unauthenticated attackers exhaust Node.js heap, exploit requires SSR enabled and specific proxy configurations.
- 8.7 /10 HighCVE-2026-101895 No auth
Angular - Denial of Service
Angular < 20.3.31, 21.2.23, and 22.1.6 contains a denial of service caused by an infinite synchronous loop in the DOM emulation parser when processing attacker-controlled incomplete DOCTYPE HTML, letting remote attackers exhaust CPU and block requests, exploit requires server-side rendering of crafted HTML.
- 8.7 /10 HighCVE-2026-101341 Auth required
NSD - Buffer Overflow
NSD contains a buffer overflow caused by unchecked token sizes in RDATA of TXT records, letting attackers perform out-of-bounds stack writes and overwrite callback pointers, exploit requires feeding crafted zone files directly to NSD.
- 8.7 /10 HighCVE-2026-101339 Auth required
NSD - Buffer Overflow
NSD contains a stack buffer overflow caused by a HIP resource record with near-limit RDATA and another dname RDATA field, letting attackers overwrite the stack with up to 191 bytes, exploit requires feeding crafted zone file directly to NSD.
- 8.7 /10 HighCVE-2026-101338 Auth required
NSD - Buffer Overflow
NSD contains a buffer overflow caused by improper handling of SVCB or HTTPS RR wire format RDATA, letting attackers overwrite the stack and write unlimited attacker-controlled data, exploit requires crafted DNS records.
- 8.7 /10 HighCVE-2026-101337 Auth required
NSD - Buffer Overflow
NSD contains a buffer overflow caused by incorrect base64 token calculation when data is split into pieces of 3 characters or less, letting attackers overwrite the stack with up to 64K of controlled data, exploit requires feeding specially crafted zone files directly to NSD.
- 7.0 /10 HighCVE-2026-100413 No auth
SeaweedFS - Information Disclosure
SeaweedFS 4.0.388 to 4.41 contains an information disclosure vulnerability caused by embedding an unencrypted Ed25519 private host key in the SFTP Helm chart, letting attackers intercept and impersonate the SFTP endpoint, exploit requires attacker to redirect or intercept client traffic.
- 8.2 /10 HighCVE-2026-100406 No auth
dbt - SQL Injection
dbt 2.0.0-alpha.0 to 2.0.0-alpha.5 contains an unauthorized SQL query execution vulnerability caused by unauthenticated access to POST /api/v1/query endpoint, letting remote attackers read arbitrary files via DuckDB functions, exploit requires network access to exposed server.
- 8.6 /10 HighCVE-2026-100236 No auth
DPDK - Out of Bounds Read/Write
DPDK GSO library contains a buffer underflow caused by improper header size validation during software GSO packet header copying, letting remote or guest attackers trigger out-of-bounds read or write, exploit requires crafted packet.
- 7.6 /10 HighCVE-2026-100169 No auth
Prowler - Authentication Bypass
Prowler 5.4.0 before 5.35.0 contains an improper authentication caused by insecure social account linking in ProwlerSocialAccountAdapter.pre_social_login(), letting remote unauthenticated attackers gain persistent access to user accounts by linking unverified emails, exploit requires open self-registration and unverified email settings.
- 7.4 /10 HighCVE-2026-100163 No auth
Appointment Booking Plugin – LatePoint - Authentication Bypass
Appointment Booking Plugin – LatePoint for WordPress <= 5.7.2 contains an authentication bypass caused by improper user existence checks in OsCustomerHelper::create_wp_user_for_customer(), letting authenticated attackers with Subscriber role take over other customers' accounts via public booking step.
- 7.2 /10 HighCVE-2026-100153 No auth
NewStatPress WordPress Plugin - Stored XSS
NewStatPress WordPress plugin <= 1.4.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in QUERY_STRING / REQUEST_URI, letting unauthenticated attackers execute scripts via crafted URLs, exploit requires shortcode on public page and URL hits.
- 7.2 /10 HighCVE-2026-0322 CISA KEVPoC publicAuth required
Palo Alto Networks PAN-OS - Remote Code Execution
Palo Alto Networks PAN-OS contains a remote code execution caused by a flaw in the management interface, letting authenticated attackers with network access execute arbitrary code with root privileges, exploit requires access to management interface.
- 7.5 /10 HighCVE-2025-71433 Auth required
Kaneo - Broken Access Control
Kaneo < 2.1.6 contains a broken access control vulnerability caused by missing authorization checks in API routes, letting authenticated users access and modify other workspaces, exploit requires user authentication.
- 8.1 /10 HighCVE-2020-37281 No auth
Gravitee API Management - Authentication Bypass
Gravitee API Management through 4.12.22 contains an authentication bypass caused by forged JWTs signed with the default jwt.secret, letting unauthenticated remote attackers impersonate any user, exploit requires knowledge of a valid user ID.