High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 394 of 568
- 8.8 /10 HighCVE-2026-92580 No auth
AVideo CloneSite - Command Injection
AVideo through 29.0 CloneSite plugin contains a stored OS command injection caused by improper escaping of SSH password in command string, letting unauthenticated remote attackers execute arbitrary commands via CSRF on admin, exploit requires enabled plugin with crontab and CSRF vulnerability.
- 8.1 /10 HighCVE-2026-92578
WWBN AVideo - Authentication Bypass
WWBN AVideo through 29.0 contains an authentication bypass caused by acceptance of stored password hash as valid credential in loginFromRequest() and encryptPasswordVerify(), letting attackers authenticate as any user by submitting the hash directly, exploit requires attacker to obtain stored password hash.
- 7.5 /10 HighCVE-2026-92577 No auth
AVideo - Broken Access Control
AVideo through 29.0 contains a broken access control vulnerability caused by improper authorization in the get_api_video endpoint clean_title branch, letting anonymous attackers access user-group-restricted videos and owner PII by querying public slugs.
- 8.6 /10 HighCVE-2026-92576 No auth
HKUDS nanobot - Server-Side Request Forgery
HKUDS nanobot < 0.3.0 contains a server-side request forgery caused by insufficient URL validation in WebFetchTool's _validate_url() function, letting attackers fetch internal services and cloud metadata, exploit requires sending crafted fetch messages.
- 8.2 /10 HighCVE-2026-92566 No auth
DataGear - Server-Side Request Forgery
DataGear <= 6.0.0 contains a server-side request forgery caused by lack of validation in /dataSet/preview/Http endpoint, letting unauthenticated attackers execute arbitrary HTTP requests to internal services.
- 8.1 /10 HighCVE-2026-92469 Auth required
zlt2000 microservices-platform - Authorization Bypass
zlt2000 microservices-platform <= 6.0.0 contains an authorization bypass caused by lack of ownership validation in file-center module DELETE /files/{id} endpoint, letting authenticated attackers delete arbitrary users' files and metadata, exploit requires authentication.
- 8.3 /10 HighCVE-2026-92467 Auth required
zlt2000 microservices-platform - Authentication Bypass
zlt2000 microservices-platform <= 6.0.0 contains a broken authentication caused by missing current password verification in PUT /users/password endpoint, letting authenticated users change any non-admin account password by supplying arbitrary user ID.
- 8.8 /10 HighCVE-2026-92466 Auth required
zlt2000 microservices-platform - Broken Access Control
zlt2000 microservices-platform <= 6.0.0 contains a broken access control vulnerability caused by the zlt.security.auth.urlPermission.enable flag defaulting to false, letting authenticated users without roles access administrative APIs, exploit requires authentication.
- 7.6 /10 HighCVE-2026-92465 Auth required
Themeum WP Mega Menu - SQL Injection
Themeum WP Mega Menu <= 1.4.2 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-92456 Auth required
yshop-crm - Broken Access Control
yshop-crm through 2.1.3 contains a broken access control vulnerability caused by lack of authorization enforcement on saveRedisSet and getRedisSet endpoints in CrmCustomerController, letting authenticated back-office users read and modify lead-allocation and customer auto-recycling policies, exploit requires authenticated back-office user access.
- 7.3 /10 HighCVE-2026-92406 No auth
SourceCodester Inventory and Monitoring System - SQL Injection
SourceCodester Inventory and Monitoring System 1.0 contains a SQL injection caused by manipulation of the "difficulty_id" argument in /admins/assessments/databank/btn_functions.php?action=add, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-92405 No auth
SourceCodester Inventory and Monitoring System - SQL Injection
SourceCodester Inventory and Monitoring System 1.0 contains a sql injection caused by manipulation of the "Username" argument in /index.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-92401 No auth
ChangeWeDer crm - Authentication Bypass
ChangeWeDer crm contains an authentication bypass caused by manipulation in top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie, letting remote attackers bypass authentication, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-92399 No auth
GPAC - Buffer Overflow
GPAC 26.07.0 contains a heap-based buffer overflow caused by manipulation of the payload_size argument in the WebSocket Handler component, letting remote attackers execute arbitrary code, exploit requires crafted payload.
- 7.3 /10 HighCVE-2026-92380 No auth
WuzhiCMS - Server-Side Request Forgery
WuzhiCMS <= 4.1.0 contains a server-side request forgery caused by manipulation of the argument source[] in ckditor::saveRemote function in coreframe/app/attachment/index.php, letting remote attackers make arbitrary requests, exploit requires no special privileges.