High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 389 of 568
- 7.7 /10 HighCVE-2026-54339 Auth required
Glean - Server-Side Request Forgery
Glean < 0.2.6 contains a server-side request forgery caused by lack of network-level validation on feed URLs in feed fetching components, letting attackers retrieve internal or cloud metadata resources, exploit requires attacker to supply malicious feed URL.
- 8.2 /10 HighCVE-2026-54253 No auth
TS3 Manager - Stored XSS & Information Disclosure
TS3 Manager < 2.2.6 contains a stored XSS caused by improper handling of the port query parameter in /api/download and insecure token cookie attributes, letting logged-in operators execute scripts and hijack sessions, exploit requires valid operator session and user interaction.
- 8.8 /10 HighCVE-2026-54239 Auth required
Faust.js FaustWP - Broken Access Control
Faust.js FaustWP WordPress plugin < 1.8.11 contains a broken access control caused by excluding the initialization vector from HMAC validation in token encryption, letting logged-in non-administrators escalate to administrator privileges and execute arbitrary code, exploit requires logged-in non-administrator access.
- 7.1 /10 HighCVE-2026-52851 Auth required
Traccar - SQL Injection
Traccar < 6.14.0 contains a SQL injection caused by improper validation of extra JSON keys in DELETE /api/permissions, letting authenticated non-readonly users extract database values or delete permission rows.
- 7.2 /10 HighCVE-2026-52727
LXC-ci Arch Linux - Authentication Bypass
LXC-ci Arch Linux images built before 2026-05-28 contain a privilege escalation caused by redistribution of pacman local-signing private key in /etc/pacman.d/gnupg, letting attackers controlling HTTP mirrors execute arbitrary code as root, exploit requires attacker to control or intercept mirror traffic.
- 8.8 /10 HighCVE-2026-52483 Auth required
MitraStar GPT-2741GNAC-N2-SV - Command Injection
MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 contains a command injection caused by concatenated parameters in /cgi-bin/device-management-utilities-internet.cgi, letting authenticated users execute arbitrary OS commands.
- 7.5 /10 HighCVE-2026-50285 No auth
Pomerium - Denial of Service
Pomerium < 0.32.8 contains a denial of service caused by unbounded zstd decompression of attacker-controlled data in decodeQueryStringV2, letting unauthenticated attackers exhaust memory and crash the proxy, exploit requires attacker to obtain receiver key and send crafted compressed payload.
- 7.5 /10 HighCVE-2026-50277 No auth
Datadog dd-trace-cpp - Denial of Service
Datadog dd-trace-cpp < 2.1.0 contains a denial of service caused by lack of enforcement of baggage size limits during extraction of W3C baggage headers, letting remote unauthenticated attackers cause unbounded CPU and memory consumption, exploit requires sending crafted headers.
- 7.5 /10 HighCVE-2026-50275 No auth
Datadog PHP Tracer - Denial of Service
Datadog PHP Tracer < 1.19.2 contains a denial of service caused by unbounded parsing of W3C baggage HTTP headers in ddtrace_deserialize_baggage, letting remote unauthenticated clients exhaust CPU and memory, exploit requires sending large or oversized baggage headers.
- 7.7 /10 HighCVE-2026-50158 No auth
Yutu - Unrestricted File Upload
Yutu < 0.10.9 contains an unrestricted file write vulnerability caused by improper path handling in caption-download MCP tool, letting a principal able to invoke caption-download write files outside YUTU_ROOT, exploit requires access to caption-download functionality and service credentials.
- 7.5 /10 HighCVE-2026-50125 No auth
MKP - Denial of Service
MKP < 0.4.1 contains a denial of service caused by unbounded memory allocation in pod logs handling, letting remote attackers exhaust server memory and terminate the service, exploit requires network access to default port 8080.
- 7.6 /10 HighCVE-2026-45726 Auth required
Omni - Broken Access Control
Omni 1.3.0 to 1.6.6 and 1.7.3 contains an information disclosure caused by improper access control on ImportedClusterSecrets resource, letting authenticated users with Reader role access CA private keys, exploit requires unrotated secrets.
- 7.0 /10 HighCVE-2026-45720
Omni - Authentication Bypass
Omni < 1.6.6 and 1.7.0 < 1.7.3 contains a broken authentication caused by race condition in SAML.getSession allowing concurrent reuse of SAML assertions, letting attackers authenticate as victims and create persistent credentials, exploit requires concurrent requests with same SAML token.
- 7.1 /10 HighCVE-2026-44236
rabbitmq-c - Buffer Overflow
rabbitmq-c < 0.16.0 contains a buffer overflow caused by accepting undersized connection.tune.frame_max value during amqp_login(), letting malicious AMQP servers cause memory corruption and denial of service, exploit requires malicious AMQP server.
- 8.8 /10 HighCVE-2026-28326 PoC publicNo auth
SolarWinds Access Rights Manager - Remote Code Execution
SolarWinds Access Rights Manager contains an unauthenticated remote code execution caused by a hardcoded static key, letting remote attackers execute arbitrary code without authentication.