High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 391 of 568
- 8.8 /10 HighCVE-2026-15815 No auth
Grafana OSS & Enterprise - Remote Code Execution
Grafana OSS and Grafana Enterprise contain a remote code execution vulnerability caused by unsafe resolution of symbolic links during plugin archive extraction, letting attackers write and execute arbitrary files outside the plugin directory, exploit requires installation of a crafted plugin archive.
- 7.8 /10 HighCVE-2025-59607
CVE-2025-59607
Memory Corruption when copying large input data exceeds normal allocation limits.
- 7.1 /10 HighCVE-2025-15697 No auth
Dictionary WordPress plugin - Reflected XSS
Dictionary WordPress plugin through 1.0 contains a reflected XSS caused by unescaped user input in several scripts, letting unauthenticated attackers execute scripts via crafted requests.
- 7.8 /10 HighCVE-2026-92816 No auth
ComfyUI - Path Traversal & Remote Code Execution
ComfyUI < 0.30.0 contains a path traversal caused by unsanitized folder_name input in dataset save nodes, letting attackers write files to arbitrary paths and execute code via modified startup files, exploit requires loading a crafted workflow.
- 7.5 /10 HighCVE-2026-92815 No auth
changedetection.io - Server Side Request Forgery
changedetection.io <= 0.60.6 contains a server-side request forgery caused by failure to validate the Goto URL action in browser steps, letting unauthenticated attackers access internal network addresses via arbitrary URLs in the optional_value parameter.
- 8.1 /10 HighCVE-2026-92806 No auth
phpList - Cross-Site Request Forgery
phpList < 3.6.17 contains a cross-site request forgery vulnerability caused by failure to validate CSRF tokens in the mass subscriber removal form handler, letting attackers induce logged-in administrators to delete and blacklist subscribers silently.
- 7.1 /10 HighCVE-2026-92804 Auth required
Nango - Server Side Request Forgery
Nango <= 0.70.4 contains a server-side request forgery caused by failure to validate caller-supplied connection configuration values in provider token and proxy URL templates, letting authenticated attackers exfiltrate provider credentials via internal or cloud metadata endpoints.
- 8.8 /10 HighCVE-2026-92801 Auth required
cc-connect - Broken Access Control
cc-connect through 1.5.0 contains a broken access control caused by failure to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks, letting attackers dispatch agent commands bypassing access controls, exploit requires attacker to trigger card actions in admitted chats.
- 8.8 /10 HighCVE-2026-92796 Auth required
Manticore Search - Broken Access Control
Manticore Search > 27.0.0 < 28.4.4 contains a broken access control caused by failure to validate permissions for all statements in multi-statement SQL requests, letting read-only attackers execute unauthorized queries and access credential tables, exploit requires ability to send multi-statement SQL queries.
- 7.5 /10 HighCVE-2026-92794 No auth
OpenSign - Authentication Bypass
OpenSign through 2.41.3 contains an information disclosure vulnerability caused by failure to validate caller identity in the getDocument cloud function when one-time-password verification is disabled, letting attackers retrieve complete document details without authentication.
- 8.1 /10 HighCVE-2026-92793 Auth required
GoAdmin - Broken Access Control
GoAdmin <= 1.2.26 contains a broken access control caused by improper anchoring of the logout pattern in permission checks, letting authenticated users bypass permissions to access admin endpoints, exploit requires authentication.
- 7.5 /10 HighCVE-2026-92792 No auth
OpenNHP - Authentication Bypass
OpenNHP through 1.0.2 contains an authentication bypass caused by attacker-supplied evidence with a test_purpose key triggering unconditional FallbackVerifier execution, letting attackers bypass attestation verification and gain unauthorized access, exploit requires attacker to provide enrolled measure and serial number pairs.
- 7.5 /10 HighCVE-2026-92791 No auth
Uber Kraken - Path Traversal
Uber Kraken through 0.1.29 contains a path traversal caused by improper validation of the tag parameter in the /tags/{tag} endpoint, letting unauthenticated attackers read arbitrary files accessible to the backend.
- 8.8 /10 HighCVE-2026-92788 Auth required
Coze Studio - Broken Access Control
Coze Studio <= 0.5.1 contains a broken access control caused by failure to validate table names in workflow SQL customization nodes, letting authenticated attackers read, insert, or delete data in other workspaces' memory databases, exploit requires authentication.
- 7.8 /10 HighCVE-2026-92786 No auth
LightGBM - Out of Bounds Write
LightGBM <= 4.7.0 contains an out-of-bounds write vulnerability caused by improper validation of child and split array values when parsing text models, letting attackers write out-of-bounds memory during SHAP prediction, exploit requires crafted malicious model files.