High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 388 of 568
- 7.8 /10 HighCVE-2026-54692 No auth
SAIL - Buffer Overflow
SAIL < 1.0.0 contains a heap overflow caused by improper handling of X10 static short files in sail_codec_load_frame_v8_xbm(), letting attackers cause crashes or potentially execute code, exploit requires loading crafted XBM images.
- 8.8 /10 HighCVE-2026-54671 Auth required
WeGIA - Broken Access Control
WeGIA < 3.8.5 contains a broken access control caused by mapping InternoControle to an empty resource array treated as unconditional access, letting low-privileged authenticated users read, modify, or delete others' records, exploit requires authentication.
- 7.2 /10 HighCVE-2026-54647 Auth required
CubeCart - SQL Injection
CubeCart prior to 6.7.5 contains a SQL injection caused by direct concatenation of administrator-controlled download_expire POST parameter in admin/sources/settings.index.inc.php, letting authenticated administrators manipulate database columns, exploit requires administrator privileges.
- 7.2 /10 HighCVE-2026-54646 Auth required
CubeCart - SQL Injection
CubeCart < 6.7.5 contains a SQL injection caused by improper validation and escaping of administrator-controlled tablename values in SQL statements, letting authenticated administrators compromise database confidentiality, integrity, and availability, exploit requires administrator privileges.
- 7.3 /10 HighCVE-2026-54634 No auth
Hamlib - Buffer Overflow & Information Disclosure
Hamlib < 4.7.2 contains a buffer overflow and information disclosure caused by out-of-bounds write and oversized copy in rigctld send_raw command, letting remote unauthenticated clients crash daemon or leak stack data.
- 8.8 /10 HighCVE-2026-54612 Auth required
Vvveb - Remote Code Execution
Vvveb 1.0.0 to 1.0.8.5 contains a file inclusion vulnerability caused by concatenation of attacker-controlled data-v-save-global file path in saveGlobalElements(), letting authenticated editors execute arbitrary PHP code remotely, exploit requires editor role with editor/* permission.
- 8.3 /10 HighCVE-2026-54597 PoC publicAuth required
ITFlow - SQL Injection
ITFlow < 26.07 contains a time-based blind SQL injection caused by unquoted insertion of the expires parameter in the share_generate_link handler in agent/ajax.php, letting authenticated users with module_support write permission extract sensitive data and potentially take over administrative accounts, exploit requires module_support write permission and access to a credential record.
- 8.1 /10 HighCVE-2026-54596 PoC publicAuth required
ITFlow - SQL Injection
ITFlow < 26.07 contains a SQL injection caused by improper sanitization of the frequency parameter in agent/post/recurring_invoice.php, letting authenticated Technicians inject SQL to expose and modify sensitive data, exploit requires authenticated Technician or higher with access to a client invoice.
- 8.1 /10 HighCVE-2026-54520 PoC publicAuth required
AI Agent Automation - Path Traversal
AI Agent Automation < 0.9.1 contains a path traversal caused by insufficient validation of user-controlled step.path in executeStep file-step, letting authenticated users read or write files outside the intended workflow directory.
- 8.8 /10 HighCVE-2026-54519 PoC publicAuth required
AI Agent Automation - Broken Access Control
AI Agent Automation < 0.9.1 contains a broken access control caused by lack of verification of agentId or memory _id ownership in memory.controller.js, letting authenticated attackers access or delete other users' AgentMemory, exploit requires attacker to be authenticated and know victim identifiers.
- 7.1 /10 HighCVE-2026-54510 No auth
Speakr - Authentication & CSRF Bypass
Speakr < 0.8.21-alpha contains a broken authentication caused by improper token validation and permanent CSRF exemption in Flask-WTF, letting network attackers bypass CSRF and modify user/admin data, exploit requires attacker-controlled sibling subdomain and crafted cross-origin requests.
- 7.6 /10 HighCVE-2026-54506 Auth required
Vvveb - Stored XSS
Vvveb < 1.0.8.5 contains a stored XSS caused by improper sanitization of user[bio] field in profile.php, letting author or higher users execute JavaScript in admin and public views, exploit requires author role or higher.
- 8.8 /10 HighCVE-2026-54504
MCP Documentation Server - Authentication Bypass
MCP Documentation Server 1.13.0 to 1.13.1 contains an authentication bypass caused by binding the document-management API to all network interfaces, letting network-reachable attackers enumerate, read, insert, delete, and tamper documents without credentials, exploit requires network access to the service.
- 8.1 /10 HighCVE-2026-54446 No auth
NetLicensing MCP Server - Broken Access Control
NetLicensing MCP Server < 0.1.6 contains a broken access control caused by missing authentication checks in ApiKeyMiddleware, letting unauthenticated attackers manage licensing objects and perform destructive operations, exploit requires no user interaction.
- 8.2 /10 HighCVE-2026-54354 No auth
MapServer - SQL Injection
MapServer < 8.6.4 contains a SQL injection caused by improper validation of numeric literals in PostGIS runtime filter translation, letting unauthenticated remote attackers bypass predicates and enumerate records via crafted input.