High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 385 of 568
- 7.5 /10 HighCVE-2026-85719 No auth
AsyncHttpClient - Information Disclosure
AsyncHttpClient 2.1.0 to 2.16.1 and 3.0.12 contain an information disclosure vulnerability caused by attaching Proxy-Authorization headers to requests without confirming HTTP proxy usage, letting attackers access proxy credentials via authenticated SOCKS proxy requests, exploit requires use of authenticated SOCKS proxy.
- 7.5 /10 HighCVE-2026-85715 No auth
ExifReader - Denial of Service
ExifReader < 4.41.1 contains a denial of service caused by unbounded allocation of extent objects when parsing crafted HEIC or AVIF ISO-BMFF files with zero field widths in iloc box, letting attackers exhaust system memory remotely, exploit requires parsing attacker-controlled files.
- 8.8 /10 HighCVE-2026-85130 No auth
WPLP Cookie Consent - Stored XSS
WPLP Cookie Consent WordPress plugin < 4.4.4 contains a stored XSS caused by unescaped user input in a public endpoint output in JavaScript context on admin screens, letting unauthenticated attackers execute arbitrary JavaScript in administrator sessions, exploit requires multisite installation.
- 7.5 /10 HighCVE-2026-85128
Choose User Role at Registration WordPress - Broken Access Control
Choose User Role at Registration WordPress plugin < 1.3.3 contains a broken access control vulnerability caused by lack of validation of requested roles at registration, letting unauthenticated users request and be granted any role including administrator, exploit requires role selection feature and public account registration enabled.
- 8.2 /10 HighCVE-2026-85077 No auth
Sanic - HTTP Response Splitting
Sanic < 24.12.1 and 25.12.0 contain an HTTP response splitting vulnerability caused by improper sanitization of header names and values in response serialization, letting attackers inject headers and split responses, exploit requires attacker-controlled data in headers or cookies.
- 7.7 /10 HighCVE-2026-81546 No auth
Affinity by Canva - Remote Code Execution
Affinity by Canva < 3.3.0 contains a buffer overflow caused by inadequate bounds checking when parsing document files, letting attackers execute arbitrary code when a crafted document is opened, exploit requires user to open malicious file.
- 7.5 /10 HighCVE-2026-81516 No auth
Steeltoe - Denial of Service
Steeltoe 4.0.0 to 4.3.0 contains a denial of service caused by strict Boolean conversion of secure metadata in ConsulDiscoveryClient, letting attackers cause service discovery outage by registering malformed service data.
- 7.5 /10 HighCVE-2026-81515 No auth
Steeltoe - Denial of Service
Steeltoe 4.0.0 to 4.3.0 contains a denial of service caused by malformed registry response deserialization in EurekaDiscoveryClient, letting principals that can register or update instances cause clients to receive empty or stale instance lists, exploit requires instance registration or update privileges.
- 7.5 /10 HighCVE-2026-81481 No auth
Dell OpenManage Server Administrator - Path Traversal
Dell OpenManage Server Administrator < 11.1.0.3 contains a path traversal caused by improper limitation of pathname to restricted directory, letting unauthenticated remote attackers access filesystem paths, exploit requires remote access.
- 7.2 /10 HighCVE-2026-81480 Auth required
Dell OpenManage Server Administrator - Buffer Overflow
Dell OpenManage Server Administrator < 11.1.0.3 contains a stack-based buffer overflow caused by improper handling of input, letting high privileged remote attackers execute arbitrary code.
- 8.1 /10 HighCVE-2026-81478 No auth
Dell OpenManage Server Administrator - Authentication Bypass
Dell OpenManage Server Administrator < 11.1.0.3 contains a hardcoded cryptographic key vulnerability, letting unauthenticated remote attackers gain unauthorized access, exploit requires remote access without authentication.
- 7.2 /10 HighCVE-2026-81477 Auth required
Dell OpenManage Server Administrator - Buffer Overflow
Dell OpenManage Server Administrator < 11.1.0.3 contains a heap-based buffer overflow caused by improper memory handling, letting high privileged remote attackers execute arbitrary code.
- 8.1 /10 HighCVE-2026-81476 No auth
Dell OpenManage Server Administrator - OS Command Injection
Dell OpenManage Server Administrator < 11.1.0.3 contains an OS command injection caused by improper neutralization of special elements, letting unauthenticated remote attackers execute arbitrary commands remotely, exploit requires remote access.
- 8.1 /10 HighCVE-2026-81475 No auth
Dell OpenManage Server Administrator - Authentication Bypass
Dell OpenManage Server Administrator < 11.1.0.3 contains a missing authentication for critical function vulnerability, letting unauthenticated remote attackers execute commands remotely, exploit requires remote access.
- 7.8 /10 HighCVE-2026-81474 Auth required
Dell OpenManage Server Administrator - Elevation of Privileges
Dell OpenManage Server Administrator < 11.1.0.3 contains a heap-based buffer overflow caused by improper memory handling, letting low privileged local attackers escalate privileges, exploit requires local access.