High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 393 of 568
- 8.1 /10 HighCVE-2026-92749
SafeLine - Authentication Bypass
SafeLine through 9.4.1 contains a broken authentication caused by deriving the management console session-signing secret from a time-seeded math/rand generator, letting unauthenticated remote attackers forge valid administrator session cookies, exploit requires bounding the install timestamp.
- 8.8 /10 HighCVE-2026-92748 Auth required
BC Security Empire - Path Traversal
BC Security Empire < 6.7.1 contains a path traversal caused by improper validation of multipart filename parameter in upload endpoints, letting authenticated operators write files to arbitrary paths for code execution.
- 8.2 /10 HighCVE-2026-92729 No auth
SigNoz - Broken Access Control
SigNoz 0.88.0 through 0.141.0 contains a broken access control caused by missing authorization wrappers on trace-funnel analytics endpoints, letting unauthenticated attackers retrieve sensitive trace analytics without credentials.
- 7.5 /10 HighCVE-2026-92719 No auth
Quickwit - Server Side Request Forgery
Quickwit <= 0.9.0 contains a server-side request forgery caused by improper validation of host and scheme in the queue_url parameter in SQS file sources, letting attackers make requests to arbitrary internal addresses, exploit requires attacker to supply a malicious queue_url to the create-source API.
- 7.3 /10 HighCVE-2026-92718
Nuclei - Command Injection
Nuclei < 3.11.1 contains a command injection caused by caching template signature verification based only on file modification time without content checksums, letting attackers replace verified templates with malicious content to execute arbitrary OS commands, exploit requires ability to replace template files.
- 7.5 /10 HighCVE-2026-92626 No auth
Control iD iDSecure - Denial of Service
Control iD iDSecure < 4.8.3.0 contains a denial of service caused by dereferencing an unset DGuard integration login state in /api/dguardintegration/dguardVersion, letting unauthenticated attackers terminate the process, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-92625 No auth
Control iD iDSecure - Denial of Service
Control iD iDSecure < 4.8.3.0 contains an unauthenticated denial of service caused by unrestricted access to /api/license/restartService endpoint, letting remote attackers repeatedly restart the service, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-92604 Auth required
Scirius - Unrestricted File Upload
Scirius <= 3.8.0 contains an unrestricted file write vulnerability caused by path traversal in the PCAP filestore upload endpoint, letting default User role attackers write arbitrary JSON files as root, exploit requires user role access.
- 7.1 /10 HighCVE-2026-92602 Auth required
TDuck survey form - Broken Access Control
TDuck survey form through 5.3 contains a broken access control vulnerability caused by lack of webhook URL validation and form ownership verification in WebhookConfigController, letting authenticated attackers attach webhooks to other users' forms and exfiltrate submissions.
- 7.5 /10 HighCVE-2026-92599 No auth
joi - Regular Expression Denial of Service
joi (npm package) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 contain a regular expression denial of service caused by an unanchored regex in Joi.string().isoDate() validation, letting remote attackers stall the application with crafted input, exploit requires attacker to supply a long fractional-second ISO date string.
- 7.5 /10 HighCVE-2026-92596 No auth
Nodemailer - Denial of Service
Nodemailer < 9.1.0 contains a denial of service caused by quadratic time complexity in the addressparser component, letting remote attackers freeze the Node.js event loop by sending crafted large address lists, exploit requires sending crafted email.
- 7.5 /10 HighCVE-2026-92594 No auth
Craft CMS - Broken Access Control
Craft CMS 5.0.0-RC1 through < 5.11.0 contains an information disclosure caused by incorrect authorization of GraphQL draftCreator and revisionCreator fields, letting clients with drafts or revisions scope access sensitive user data, exploit requires access to GraphQL drafts or revisions scope.
- 8.8 /10 HighCVE-2026-92593 Auth required
Craft CMS - Server-Side Template Injection
Craft CMS 5.10.0 through 5.10.12 contains a server-side template injection caused by unsandboxed View::renderObjectTemplate() sink and token misuse, letting authenticated low-privilege control panel users execute arbitrary PHP code, exploit requires edit rights on a single element type.
- 8.8 /10 HighCVE-2026-92592 PoC publicAuth required
Craft CMS - Remote Code Execution
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 contain a remote code execution caused by improper HMAC signature binding in license-shun cookie and redirect parameters, letting authenticated non-admin users execute arbitrary OS commands via unsandboxed Twig templates, exploit requires password authentication without 2FA and PHP system() availability.
- 7.1 /10 HighCVE-2026-92582 No auth
AVideo - Cross-Site Request Forgery
AVideo (WWBN/AVideo) through 29.0 contains a cross-site request forgery caused by disabled CSRF and untrusted-request checks in objects/videoAddNew.json.php, letting attackers modify video records via crafted cross-origin requests, exploit requires victim to be authenticated with upload rights.