High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 375 of 568
- 8.1 /10 HighCVE-2026-92919 Auth required
admin3 - Path Traversal
admin3 <= 3.0.0 contains a path traversal caused by failure to sanitize client-supplied filenames in the upload handler on Windows, letting authenticated users write files outside storage root, exploit requires authentication.
- 8.8 /10 HighCVE-2026-92918 Auth required
admin3 - Broken Access Control
admin3 <= 3.0.0 contains an information disclosure caused by persisting user session tokens in audit log event bodies, letting attackers with log:view permission harvest session tokens and gain full user access, exploit requires log:view permission.
- 7.5 /10 HighCVE-2026-92917 No auth
Grav - Information Disclosure
Grav 2.0.0-rc.1 through 2.0.21 contains an information disclosure vulnerability caused by improper sandbox filtering in Twig content sandbox, letting authenticated users with page-edit rights dump sensitive configuration data, exploit requires page-edit rights.
- 7.5 /10 HighCVE-2026-92916 No auth
Grav - Information Disclosure
Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21 contain an information disclosure vulnerability caused by unauthenticated access to the Clockwork profiler endpoint when debugger is enabled, letting remote attackers access sensitive session cookies, credentials, and configuration data, exploit requires debugger enabled with exposed /__clockwork/ endpoint.
- 7.3 /10 HighCVE-2026-92915 No auth
WWBN AVideo - Broken Access Control
WWBN AVideo contains a broken access control vulnerability in objects/userVerifyEmail.php caused by lack of login, CSRF protection, and rate limiting, letting unauthenticated attackers send unlimited verification emails and reset passwords, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-92914 Auth required
AVideo LoginControl - Authentication Bypass
AVideo LoginControl contains an authentication bypass caused by loose equality comparison against an uninitialized session variable in PGP second factor verification, letting attackers with victim's password bypass second factor by sending parameter-less GET request.
- 7.4 /10 HighCVE-2026-92913 No auth
AVideo - Authentication Bypass
AVideo contains a broken authentication caused by use of a weak pseudo-random number generator in account activation and login pairing codes, letting unauthenticated remote attackers guess valid codes to take over accounts, exploit requires unauthenticated access to login_code API.
- 8.2 /10 HighCVE-2026-92903 Auth required
Snowflake CLI - Command Injection
Snowflake CLI < 3.27.0 contains a command injection caused by unsanitized user-controlled input interpolated into SQL multi-statement queries, letting attackers execute arbitrary SQL in victim's Snowflake session, exploit requires write or pull-request access to project repository or supply untrusted input to CLI automation.
- 7.8 /10 HighCVE-2026-92838 Auth required
GeoVision GV-Remote E-Map - DLL Hijacking
GeoVision GV-Remote E-Map desktop application contains a DLL hijacking vulnerability caused by loading DLLs from an unsafe search path, letting local attackers execute arbitrary code, exploit requires local write access to the affected directory.
- 7.1 /10 HighCVE-2026-92525 Auth required
Linux Kernel RDMA/rxe - Out-of-Bounds Read
Linux kernel RDMA/rxe contains an out-of-bounds read vulnerability caused by lack of validation of num_sge and cur_sge in user QP WQE, letting local unprivileged users cause a denial of service via out-of-bounds read, exploit requires local user access.
- 7.3 /10 HighCVE-2026-92522 No auth
Linux Kernel - Out of Bounds Read/Write
Linux kernel contains an ACPI processor vulnerability caused by improper validation of MADT IOAPIC entry bounds, letting attackers potentially cause memory corruption or denial of service, exploit requires crafted ACPI tables.
- 7.8 /10 HighCVE-2026-92518
Linux Kernel - Kernel Stack Corruption
Linux kernel contains a kernel stack corruption caused by incorrect tailcall jump offset with CONFIG_CFI_CLANG enabled in BPF riscv, letting attackers cause kernel stack corruption, exploit requires kernel with CONFIG_CFI_CLANG enabled.
- 7.8 /10 HighCVE-2026-92511 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by improper synchronization in ib_destroy_cq_user() during CQ destruction, letting attackers potentially access freed resources, exploit requires access to netlink path.
- 7.8 /10 HighCVE-2026-92510
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by improper synchronization in ib_destroy_srq_user() during SRQ destruction, letting attackers potentially access freed resources, exploit requires access to netlink path.
- 7.8 /10 HighCVE-2026-92508
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by delayed removal of CQ from restrack in ib_free_cq(), letting attackers cause memory corruption or system instability, exploit requires access to netlink path.