High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 352 of 568
- 7.7 /10 HighCVE-2026-63330 Auth required
Warpgate - Broken Access Control
Warpgate < 0.25.6 contains an information disclosure vulnerability caused by missing admin permission checks in api_get_recording_stream, letting authenticated users access real-time session recordings, exploit requires user authentication.
- 8.8 /10 HighCVE-2026-63116 Auth required
Deepstream - Broken Access Control
Deepstream 10.1.0 to 10.1.1 contains a broken access control caused by omission of RECORD_ACTION.PATCH_MULTI in RULES_MAP, letting authenticated users modify arbitrary protected records, exploit requires authenticated user.
- 8.8 /10 HighCVE-2026-62371 Auth required
KubeEdge - Command Injection
KubeEdge v1alpha2 NodeUpgradeJob handler in versions 1.12.0 to 1.21.2, 1.22.2, and 1.23.1 contains a command injection caused by concatenation of authenticated user-controlled spec.version and spec.image into shell commands, letting users with NodeUpgradeJob create/update permissions execute arbitrary commands on edge nodes, exploit requires permission to create or update NodeUpgradeJob resources.
- 8.1 /10 HighCVE-2026-62369
KubeEdge - Path Traversal
KubeEdge 1.16.0 to <1.21.2, 1.22.2, 1.23.1 contains a path traversal caused by insufficient validation in DecompressTarGz function during keadm join or installation on Windows edge nodes, letting attackers write or overwrite files with keadm privileges, exploit requires compromised or untrusted archive source.
- 8.8 /10 HighCVE-2026-62182 Auth required
KubeEdge - Command Injection
KubeEdge 1.21.0 to 1.21.2, 1.22.2, and 1.23.1 contains a command injection caused by concatenation of user-controlled updateFields into keadm config-update command executed via system shell, letting authenticated users execute arbitrary commands with KubeEdge process privileges, exploit requires permission to create or modify ConfigUpdateJob resources.
- 7.1 /10 HighCVE-2026-61687 No auth
Hatchet - Authentication Bypass
Hatchet < 0.91.1 contains an authentication bypass caused by improper clearing of oauth_state_ session value in ValidateOAuthState, letting unauthenticated attackers bind victim sessions to attacker-controlled OAuth identities, exploit requires victim to complete OAuth flow and specific auth integrations enabled.
- 7.5 /10 HighCVE-2026-61629 No auth
nginx-ignition - Denial of Service
nginx-ignition 2.29.0 through 2.40.0 contains a denial of service caused by unfiltered Accept-Language header parsing in gin i18n middleware, letting unauthenticated attackers cause high CPU usage, exploit requires crafted Accept-Language header.
- 8.1 /10 HighCVE-2026-61628 PoC publicNo auth
nginx ignition - Broken Access Control
nginx ignition < 2.41.1 contains a broken access control caused by a TOCTOU race condition in POST /api/users/onboarding/finish, letting remote unauthenticated attackers create admin accounts, exploit requires instance in pre-onboarding state.
- 7.6 /10 HighCVE-2026-59814 Auth required
Joplin Server - Stored XSS
Joplin Server < 3.7.7 contains a stored XSS caused by serving resources with attacker-controlled mime types and empty titles in GET /shares/:id?resource_id=, letting low-privileged users execute scripts in victim's browser, exploit requires publishing an empty-title SVG attachment.
- 8.1 /10 HighCVE-2026-58269 Auth required
Sync-in Server - Authentication Bypass
Sync-in Server < 2.4.0 contains a 2FA bypass caused by missing 2FA enforcement in POST /api/auth/token, letting attackers with stolen credentials bypass two-factor authentication in a single request.
- 8.8 /10 HighCVE-2026-55897 Auth required
luci-app-advanced-reboot - Command Injection
luci-app-advanced-reboot < 1.1.2-6 contains a command injection caused by rpcd file.exec permission granted to /bin/sh in ACL, letting authenticated delegated sessions execute arbitrary commands as root, exploit requires authenticated delegated session.
- 7.8 /10 HighCVE-2026-55567 Auth required
BleachBit - Broken Access Control
BleachBit < 6.0.1 contains an arbitrary privileged file deletion vulnerability caused by lack of locking and validation of target's parent directory before deletion, letting local unprivileged users delete attacker-selected files, exploit requires local access.
- 7.4 /10 HighCVE-2026-55210 No auth
Joplin Server - Authentication Bypass
Joplin Server < 3.7.2 contains an authentication bypass caused by UserModel.ssoLogin() returning accounts without checking is_external flag, letting attackers with IdP session access local user accounts, exploit requires IdP session asserting local user's email.
- 8.8 /10 HighCVE-2026-55159 Auth required
luci-app-adblock-fast - Command Injection
luci-app-adblock-fast < 1.2.4-2 contains a command injection caused by improper handling of carriage-return or line-feed characters in the setCronEntry RPC method, letting authenticated delegated users with write ACL execute persistent commands as root, exploit requires write ACL.
- 7.7 /10 HighCVE-2026-55105 Auth required
Joplin - Stored XSS
Joplin < 3.6.15 and < 3.7.2 contains a stored XSS caused by unsanitized HTML output from fountain.js renderer in note output, letting attackers execute scripts via malicious Fountain code blocks, exploit requires Fountain rendering enabled.