High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 359 of 568
- 7.6 /10 HighCVE-2026-93591 Auth required
SiYuan - SQL Injection
SiYuan < 3.8.3 contains an sql injection caused by unescaped tag values concatenated in graph.go query2Stmt function, letting publish-mode readers or anonymous visitors execute arbitrary SQL queries, exploit requires crafted inline HTML span tags.
- 7.5 /10 HighCVE-2026-93576 No auth
Netty netty-codec-smtp - Input Validation Bypass
Netty netty-codec-smtp contains an incomplete CRLF validation fix in the SMTP command-name field, letting attackers potentially bypass input validation, exploit requires crafted SMTP commands.
- 7.5 /10 HighCVE-2026-93575 No auth
Netty - Denial of Service
Netty contains a denial of service vulnerability caused by improper validation of MQTT Properties Length against Remaining Length in MqttDecoder, letting unauthenticated remote attackers exhaust memory and CPU by sending crafted packets, exploit requires network access.
- 7.5 /10 HighCVE-2026-93572 No auth
RedisArrayAggregator - Denial of Service
RedisArrayAggregator contains a resource exhaustion vulnerability caused by eager allocation of large nested RESP array headers, letting attackers exhaust memory by sending deeply nested large arrays, exploit requires sending crafted nested RESP arrays.
- 8.2 /10 HighCVE-2026-93569
CVE-2026-93569
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
- 7.5 /10 HighCVE-2026-93568
CVE-2026-93568
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
- 7.5 /10 HighCVE-2026-93567 No auth
HTTP Protocol - HTTP Request Smuggling
An HTTP/1 CONNECT request with authority-form is translated to a malformed HTTP/2 CONNECT request with a Host-controlled :authority header, allowing attackers to manipulate request routing or cause unexpected behavior.
- 7.5 /10 HighCVE-2026-93565 No auth
Netty RtspMethods - Authentication Bypass
Netty RtspMethods contains a broken authentication caused by RtspMethods.valueOf() silently stripping trailing control bytes before cache lookup, letting remote attackers send malformed RTSP methods that are accepted as valid, exploit requires sending RTSP requests with trailing control bytes.
- 7.5 /10 HighCVE-2026-93564 No auth
HAProxy - Resource Leak
HAProxy contains a PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak caused by incomplete fix of PR #16881, letting attackers cause resource leaks, exploit requires crafted PROXY-v2 nested-TLV packets.
- 7.5 /10 HighCVE-2026-93563 No auth
Unspecified Product - Denial of Service
An unspecified vendor's product contains a denial of service caused by unbounded multi-line response accumulation in SmtpResponseDecoder, letting attackers exhaust memory remotely, exploit requires crafted SMTP responses.
- 7.5 /10 HighCVE-2026-93560 No auth
STOMP Codec - Denial of Service
STOMP codec contains an infinite decode loop denial of service caused by content-length long-to-int truncation, letting attackers cause service disruption, exploit requires crafted STOMP messages.
- 7.3 /10 HighCVE-2026-93559 No auth
Forget-C Jellyfish AI Short Drama Studio - Authentication Bypass
Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha to 0.3.2 contains a broken authentication caused by manipulation in backend/app/dependencies.py FastAPI component, letting remote attackers bypass authentication, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-93558 No auth
WebSocketServerExtensionHandler - Denial of Service
WebSocketServerExtensionHandler contains a denial of service caused by unbounded per-connection queue growth, letting attackers exhaust resources and cause service disruption, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-93494 No auth
Netty - Denial of Service
Netty StompSubframeDecoder contains a denial of service caused by missing terminating null byte in STOMP frame body leading to unreleased ByteBuf memory leak, letting remote attackers cause application DoS, exploit requires crafted STOMP frame.
- 7.5 /10 HighCVE-2026-93491 No auth
Netty HttpServerCodec - Denial of Service
Netty HttpServerCodec contains a denial of service caused by unbounded heap memory consumption from pipelined HTTP/1.1 requests with withheld reads, letting remote unauthenticated attackers exhaust memory, exploit requires HTTP/1.1 pipelining.