High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 392 of 568
- 8.1 /10 HighCVE-2026-92785 No auth
Angel - Insecure Deserialization
Angel through 3.3.0 contains an insecure deserialization vulnerability caused by untrusted setAlgoMetrics payload deserialized using Kryo without class registration or allowlist validation, letting unauthenticated network attackers execute arbitrary code or exhaust memory by sending crafted serialized objects to the master RPC endpoint.
- 7.5 /10 HighCVE-2026-92784
@refinedev/inferencer - Stored XSS
@refinedev/inferencer <= 7.0.0 contains a stored XSS caused by failure to escape API field names in generated JSX, letting attackers controlling data provider execute malicious JavaScript in developer's browser, exploit requires attacker control of data provider.
- 8.1 /10 HighCVE-2026-92783 Auth required
Yeti - Broken Access Control
Yeti through 2.11.0 contains a broken access control vulnerability caused by failure to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, letting users with read access delete access control relationships, exploit requires user to have read access.
- 8.1 /10 HighCVE-2026-92782 Auth required
Chroma - Broken Access Control
Chroma <= 1.5.9 contains a broken access control caused by failure to validate tenant and database segments when resolving collections, letting authenticated attackers read and modify records in other tenants' collections, exploit requires authentication.
- 8.8 /10 HighCVE-2026-92780 Auth required
KnowStreaming - Broken Access Control
KnowStreaming through 3.4.1 contains a broken access control vulnerability caused by failure to enforce role-based access control on REST API endpoints, letting authenticated users escalate privileges to administrator, exploit requires authentication.
- 7.6 /10 HighCVE-2026-92779 Auth required
Builder.io Gen2 SDKs - Prototype Pollution
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability caused by unvalidated processing of content block bindings in the deep-set helper function, letting attackers pollute Object.prototype during rendering, exploit requires crafted content blocks with specific binding keys.
- 8.1 /10 HighCVE-2026-92776 Auth required
Wiki.js - Broken Access Control
Wiki.js through 2.5.314 contains a broken access control caused by failure to require path separators when matching START and END page rules, letting attackers with folder access read and modify unrelated pages with matching prefixes, exploit requires user to have folder access.
- 7.1 /10 HighCVE-2026-92773
Trigger.dev - Broken Access Control
Trigger.dev < 4.6.0 contains a broken access control caused by failure to verify authenticated user ownership of GitHub App installation, letting attackers claim others' installations and access repositories, exploit requires replaying state cookies and sequential installation IDs.
- 7.1 /10 HighCVE-2026-92772 Auth required
Leantime - Authorization Bypass
Leantime before 3.9.6 contains an authorization bypass caused by lack of permission validation in the HTMX plugin install endpoint, letting authenticated users with limited roles install malicious plugins, exploit requires authentication.
- 8.1 /10 HighCVE-2026-92763 Auth required
Rundeck - Broken Access Control
Rundeck <= 6.2.1 contains a broken access control caused by improper authorization of importConfig and importNodesSources parameters in the project archive import endpoint, letting attackers with import action replace security-relevant project configuration files, exploit requires import action privilege.
- 8.8 /10 HighCVE-2026-92762 Auth required
Pelican Panel - Broken Access Control
Pelican Panel < 1.0.0-beta35 contains a broken access control vulnerability caused by enforcing startup write permissions only through disabled form controls, letting attackers with startup.read permission execute arbitrary commands in the container via Livewire state updates.
- 8.8 /10 HighCVE-2026-92761 Auth required
WebVirtCloud - Broken Access Control
WebVirtCloud contains a broken access control caused by improper validation of permission flags in UserInstance grants, letting attackers with read-only grants perform privileged actions, exploit requires attacker to have read-only grants.
- 7.1 /10 HighCVE-2026-92753 Auth required
PatrowlManager - Authorization Bypass
PatrowlManager through 1.8.4 contains an authorization bypass caused by lack of ownership filtering in events and alerts API endpoints, letting authenticated attackers read, delete, and modify other users' events and alerts.
- 8.3 /10 HighCVE-2026-92752 Auth required
metasfresh - Broken Access Control
metasfresh contains a broken access control caused by lack of record-level permission enforcement in DocumentAttachmentsRestController and CommentsRestController endpoints, letting logged-in attackers read, replace, and delete attachments and comments on unauthorized records, exploit requires attacker to be logged in.
- 8.1 /10 HighCVE-2026-92751 No auth
CMAK - Cross-Site Request Forgery
CMAK <= 3.0.0.6 contains a cross-site request forgery vulnerability caused by missing CSRF filter installation, letting attackers perform state-changing actions on behalf of authenticated operators, exploit requires operator authentication.