High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 364 of 568
- 8.8 /10 HighCVE-2026-84034 Auth required
IBM Guardium Data Protection - Hardcoded Credentials
IBM Guardium Data Protection 12.2 contains a hardcoded credentials vulnerability in hardware_assess/obstore binaries, letting low-privileged authenticated users recover master secrets and access internal database.
- 8.2 /10 HighCVE-2026-83946 No auth
Azure Portal - Reflected XSS
Azure Portal contains a reflected XSS caused by improper neutralization of input during web page generation, letting unauthorized attackers perform spoofing over a network, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-83561 No auth
Complianz GDPR/CCPA Cookie Consent Banner - Stored XSS
Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress <= 7.5.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Comment Content via Elementor Cookie Blocker Regex, letting unauthenticated attackers inject scripts executed on user page access, exploit requires admin approval of attacker comment and specific plugin configurations.
- 7.6 /10 HighCVE-2026-82896 Auth required
IBM Guardium Data Protection - Path Traversal
IBM Guardium Data Protection 12.2 contains a path traversal caused by improper input validation, letting remote authenticated attackers access arbitrary directories, exploit requires authentication.
- 7.8 /10 HighCVE-2026-82893 Auth required
IBM Guardium Data Protection - Privilege Escalation
IBM Guardium Data Protection 12.2 contains a privilege escalation caused by improper privilege management, letting local attackers gain elevated privileges, exploit requires local access.
- 8.1 /10 HighCVE-2026-82892 No auth
IBM Guardium Data Protection - Command Injection
IBM Guardium Data Protection 12.2 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote attackers execute arbitrary commands, exploit requires network access.
- 8.8 /10 HighCVE-2026-82887 Auth required
IBM Guardium Data Protection - Command Injection
IBM Guardium Data Protection 12.2 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.
- 8.8 /10 HighCVE-2026-82885 Auth required
IBM Guardium Data Protection - Broken Access Control
IBM Guardium Data Protection 12.2 contains a broken access control caused by missing authorization in the REST API, letting remote authenticated attackers gain elevated privileges.
- 7.5 /10 HighCVE-2026-81944 Auth required
PLANET IGS-5225-8P2T4S - Buffer Overflow
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow caused by insufficient bounds checking in the web server, letting remote authenticated attackers cause denial of service or execute arbitrary code.
- 8.8 /10 HighCVE-2026-81942 Auth required
PLANET IGS-5225-8P2T4S - Command Injection & Privilege Escalation
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware < 1.2412b260707 and < 2.2412b260519 contain a command injection caused by insufficient filtering of user input in the web server, letting remote authenticated attackers execute arbitrary OS commands and escalate privileges to root.
- 7.2 /10 HighCVE-2026-81937 Auth required
IBM Guardium Data Protection - Command Injection
IBM Guardium Data Protection 12.2 contains a command injection caused by improper sanitization of the filename parameter in the import remotelog_config CLI command, letting highly privileged authenticated users execute arbitrary commands with root privileges.
- 8.8 /10 HighCVE-2026-81933 Auth required
IBM Guardium Data Protection - SQL Injection
IBM Guardium Data Protection 12.2 contains a sql injection caused by improper input sanitization in the Analytic Grid Service Handler, letting low-privileged authenticated users access sensitive data and impact system confidentiality, integrity, and availability, exploit requires low-privileged authentication.
- 7.2 /10 HighCVE-2026-81810 Auth required
All-in-One WP Migration and Backup WordPress plugin - Broken Access Control
All-in-One WP Migration and Backup WordPress plugin < 7.111 contains a broken access control vulnerability caused by missing capability checks on AJAX actions gated by an installation-wide secret, letting users with export capability gain administrator access by importing arbitrary site archives, exploit requires misconfiguration granting export capability to non-import roles.
- 7.2 /10 HighCVE-2026-81669 Auth required
IBM Guardium Data Protection - Command Injection
IBM Guardium Data Protection 12.2 contains a command injection caused by improper sanitization of the alias input in the create csr wildcard CLI command, letting authenticated privileged CLI users execute arbitrary commands with root privileges.
- 8.8 /10 HighCVE-2026-81656 Auth required
IBM Guardium Data Protection - SQL Injection
IBM Guardium Data Protection 12.2 contains a sql injection caused by improper sanitization in the New Query Builder REST Processor, letting low-privileged authenticated users access or modify data, exploit requires authentication.