High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 35 of 725
- 7.5 /10 HighCVE-2026-119025 PoC publicNo auth
Open - Command Injection
Open 7.2.0 < 11.0.0 contains an OS command injection caused by unescaped PowerShell command execution from crafted URLs in index.js, letting attackers execute arbitrary PowerShell code remotely, exploit requires crafted URL input.
- 7.5 /10 HighCVE-2026-118782 No auth
Forge - Authentication Bypass
Forge (node-forge) < 1.4.1 contains a broken authentication caused by accepting PKCS#12 MAC or password-based encryption iteration count of zero or less, letting attackers bypass password-based integrity checks with crafted input, exploit requires crafted PKCS#12 input.
- 7.5 /10 HighCVE-2026-118779 No auth
Forge - Denial of Service
Forge (node-forge) < 1.4.1 contains a denial of service caused by polynomial-time regular expressions in pem.decode() missing END line checks, letting unauthenticated attackers cause excessive CPU consumption with malformed PEM input.
- 7.5 /10 HighCVE-2026-118772 No auth
Joi - Denial of Service
Joi 17.1.1 to 17.13.9 and 18.3.1 contain a denial of service caused by inefficient regex processing in string().email({ multiple: true }) rule, letting attackers block the Node.js event loop, exploit requires attacker-controlled input with multiple option and no effective length limit.
- 7.3 /10 HighCVE-2026-118765 Auth required
Botan - Weak Cryptography
Botan 3.7.0 to 3.13.0 contains a weak random number generator seeding caused by calling AutoSeeded_RNG::clear() followed by randomize with an empty buffer while unseeded, letting attackers predict RNG output, exploit requires unseeded RNG state.
- 7.4 /10 HighCVE-2026-118763 No auth
sigstore-js - Information Disclosure
sigstore-js < 0.7.2 contains an information disclosure caused by RegistryClient.uploadBlob() sending authentication headers to attacker-controlled hosts, letting malicious registries steal bearer tokens and credentials, exploit requires interaction with a malicious registry.
- 7.5 /10 HighCVE-2026-118761 No auth
Kubeflow Pipelines - Denial of Service
Kubeflow Pipelines < 2.18.0 contains a denial of service caused by unbounded decompression of uploaded pipeline archives in the API server, letting reachable callers exhaust memory and resources without authorization, exploit requires sending crafted compressed archives.
- 7.5 /10 HighCVE-2026-118759
Kubeflow Pipelines - Broken Access Control
Kubeflow Pipelines < 2.18.0 contains an information disclosure caused by missing authorization in the API server's log retrieval handler, letting attackers with backend access read logs of arbitrary runs and pods, exploit requires backend access and knowledge of run and node IDs.
- 7.5 /10 HighCVE-2026-118758 No auth
Kubeflow Pipelines - Path Traversal
Kubeflow Pipelines < 2.18.0 contains a path traversal vulnerability caused by insufficient confinement of caller-supplied file paths in the volume artifact handler, letting attackers read files outside the selected volume, exploit requires access to the artifact GET route and volume identification.
- 7.1 /10 HighCVE-2026-118085 No auth
GlobalPayments WooCommerce - Reflected XSS
GlobalPayments WooCommerce <= 1.23.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-118083 No auth
WP Crowdfunding - Information Disclosure
WP Crowdfunding <= 2.2.2 contains an information disclosure caused by unauthenticated access to sensitive data, letting unauthenticated attackers access sensitive information remotely, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-118082 Auth required
Buddyboss Platform - Privilege Escalation
Buddyboss Platform <= 3.5.0 contains a privilege escalation vulnerability caused by improper access control, letting subscribers escalate their privileges, exploit requires subscriber account.
- 8.8 /10 HighCVE-2026-118081 Auth required
10Web Social Photo Feed - PHP Object Injection
10Web Social Photo Feed <= 1.5.6 contains a PHP Object Injection caused by unsafe unserialize usage, letting attackers inject arbitrary objects to manipulate application behavior, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-118080 Auth required
Social Snap - PHP Object Injection
Social Snap <= 1.5.4 contains a PHP Object Injection caused by unsafe deserialization, letting attackers inject malicious objects to execute arbitrary code, exploit requires crafted input.
- 7.2 /10 HighCVE-2026-118079 Auth required
FV Flowplayer Video Player - PHP Object Injection
Shop manager FV Flowplayer Video Player <= 8.3.4 contains a PHP Object Injection caused by unsafe unserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.