High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 353 of 568
- 8.4 /10 HighCVE-2026-55071 No auth
MCP-for-Stata - Command Injection
MCP-for-Stata < 1.19.0 contains a command injection caused by unsanitized user input concatenated into Stata command strings in ado_package_install tool, letting attackers execute arbitrary OS commands remotely, exploit requires ability to invoke the MCP tool or Python API.
- 8.8 /10 HighCVE-2026-53940 No auth
Conda - Path Traversal & Remote Code Execution
Conda < 26.5.2 contains a path traversal caused by unvalidated entry-point commands in noarch:python package metadata, letting attackers write files outside the installation prefix or overwrite entry points, exploit requires package installation.
- 8.4 /10 HighCVE-2026-49811 Auth required
Dell Command | Monitor - Privilege Escalation
Dell Command | Monitor (DCM) < 10.13.2 contains an incorrect permission assignment for critical resource, letting low privileged local attackers elevate their privileges, exploit requires local access.
- 7.8 /10 HighCVE-2026-49810 Auth required
Dell Command Powershell Provider - Information Disclosure
Dell Command Powershell Provider (DCPP) < 2.10.2 contains an insertion of sensitive information into log file vulnerability caused by improper handling of sensitive data, letting low privileged local attackers disclose information, exploit requires local access.
- 7.0 /10 HighCVE-2026-49453 No auth
Joplin - Path Traversal
Joplin < 3.6.15 and < 3.7.2 contains a path traversal caused by unvalidated resource metadata in synchronized resources, letting attackers with write access to sync targets overwrite files at arbitrary paths without user interaction.
- 7.1 /10 HighCVE-2026-49450 No auth
Joplin Desktop - Remote Code Execution
Joplin Desktop for Windows < 3.7.2 contains a code execution vulnerability caused by omission of publisherName in package.json, letting attackers controlling update delivery run code with user privileges after user approval.
- 8.1 /10 HighCVE-2026-48976 Auth required
HomeBox - Broken Access Control
HomeBox < 0.26.0 contains a broken access control vulnerability caused by NotifierRepository.Update not verifying user ownership, letting authenticated users read or modify other tenants' notifier URLs including plaintext credentials, exploit requires authentication.
- 8.1 /10 HighCVE-2026-48975 Auth required
HomeBox - Broken Access Control
HomeBox < 0.26.0 contains a broken access control caused by missing verification of maintenance entry ownership in UpdateOneID and DeleteOneID methods, letting authenticated low-privileged users modify or delete other tenants' records, exploit requires authentication.
- 8.1 /10 HighCVE-2026-48826 Auth required
HomeBox - Broken Access Control
HomeBox < 0.26.0 contains a broken access control caused by improper authorization using global owner value instead of caller's role in active group, letting authenticated users delete complete inventory of other groups, exploit requires user membership in multiple groups.
- 7.5 /10 HighCVE-2026-47321 No auth
Apache MINA - Denial of Service
Apache MINA CompressionFilter contains a denial of service vulnerability caused by unbounded decompression size in ZLib inflate, letting attackers exhaust application memory, exploit requires sending specially crafted compressed data.
- 7.2 /10 HighCVE-2026-36467 Auth required
CuteNews - Unrestricted File Upload
CuteNews 2.1.2 contains an unrestricted file upload vulnerability in core/modules/media.php, letting remote authenticated users with Media Manager access execute arbitrary code, exploit requires authentication and Media Manager access.
- 7.8 /10 HighCVE-2026-17052 Auth required
Zephyr Time-aware GPIO - Write-What-Where
Zephyr Time-aware GPIO (CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y) contains a write-what-where vulnerability caused by missing K_SYSCALL_MEMORY_WRITE() checks in z_vrfy_tgpio_pin_read_ts_ec(), letting unprivileged users with device access write arbitrary kernel memory, exploit requires access to TGPIO device object.
- 8.0 /10 HighCVE-2026-15801 Auth required
CRI-O - Broken Access Control
CRI-O contains a broken access control vulnerability caused by insufficient validation of restore metadata in container checkpoint and restore feature, letting users with sufficient privileges perform unintended host filesystem operations, exploit requires container checkpoint and restore enabled and untrusted checkpoint content.
- 7.2 /10 HighCVE-2025-71421 Auth required
UVdesk core-framework - Broken Access Control
UVdesk core-framework < 1.1.7 contains a broken access control vulnerability in the editAgent endpoint, letting agents with agent-management privilege escalate their role to administrator, exploit requires agent-management privilege.
- 8.0 /10 HighCVE-2026-94109 Auth required
openEQUELLA - Remote Code Execution
openEQUELLA < 2026.1.0 contains a remote code execution caused by unsandboxed TemplateClassResolver in FreeMarker template compilation, letting authenticated attackers execute arbitrary commands via malicious template expressions.