High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 405 of 568
- 7.2 /10 HighCVE-2026-86865 Auth required
Tanium Asset - SQL Injection
Tanium Asset contains a sql injection vulnerability caused by unsanitized input, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
- 8.7 /10 HighCVE-2026-86831 Auth required
Amazon EKS Network Policy Agent - Broken Access Control
Amazon EKS Network Policy Agent < 1.4.0 contains a broken access control caused by improper validation of pod identifier uniqueness, letting authenticated remote users bypass NetworkPolicy enforcement on co-located pods via crafted pod and namespace names.
- 8.8 /10 HighCVE-2026-86792 Auth required
Apache Airflow Apache Kafka provider - Remote Code Execution
Apache Airflow Apache Kafka provider < 2.0.0 contains a remote code execution caused by unsanitized dotted-path strings in Kafka connection's `extra` field passed to confluent-kafka client, letting users with connection edit privileges execute arbitrary code in the scheduler process, exploit requires Kafka event producer enabled.
- 8.1 /10 HighCVE-2026-86466 Auth required
Apache Airflow FAB provider - Authentication Bypass
Apache Airflow FAB provider contains an authentication bypass caused by missing validation of issuer and audience claims in the Authentik OAuth path, letting attackers with valid tokens for other applications authenticate as arbitrary users, exploit requires attacker to have a valid token for another application.
- 7.1 /10 HighCVE-2026-86444 CISA KEVNo auth
LearnPress WordPress plugin - Stored XSS
LearnPress WordPress plugin < 4.4.7 contains a stored XSS caused by unescaped user-supplied value in an HTML attribute on public pages, letting unauthenticated attackers execute arbitrary JavaScript, exploit requires classic non-block editor.
- 8.5 /10 HighCVE-2026-86359 Auth required
Dell Repository Manager - Privilege Escalation
Dell Repository Manager < 3.5.2 contains an incorrect default permissions vulnerability, letting low privileged remote attackers elevate their privileges, exploit requires remote access.
- 8.0 /10 HighCVE-2026-86108 Auth required
VeloCloud Edge - Command Injection
VeloCloud Edge contains a command injection caused by insufficient validation of inputs in management and configuration workflows, letting authorized users execute OS commands with elevated privileges, exploit requires authorized management access.
- 7.1 /10 HighCVE-2026-86089 Auth required
Apache NiFi - Broken Access Control
Apache NiFi 2.11.0 contains a broken access control vulnerability caused by missing authorization checks on Process Groups during migration via REST API, letting authenticated users with Connector access enumerate or migrate Process Groups without proper permissions, exploit requires authenticated user with Connector read or write access.
- 7.5 /10 HighCVE-2026-86043 No auth
Skipper - Authorization Bypass
Skipper < 0.27.37 contains an authorization bypass caused by incorrect handling of truncated request bodies in opaAuthorizeRequestWithBody filter, letting attackers bypass body inspection and authorize oversized requests, exploit requires crafted HTTP requests with chunked or HTTP/2 transfer encoding.
- 7.5 /10 HighCVE-2026-86003
CoreDNS - Broken Access Control
CoreDNS < 1.14.7 contains a broken access control vulnerability caused by missing dns.DefaultMsgAcceptFunc policy in DNS-over-HTTPS, HTTP/3, QUIC, and gRPC listeners, letting unauthenticated clients perform unauthorized DNS updates, exploit requires upstream trusting CoreDNS source without end-to-end TSIG.
- 7.5 /10 HighCVE-2026-85756 Auth required
SSH.NET - Command Injection
SSH.NET < 2026.0.0 contains a command injection caused by unsafe quoting of remote paths in ScpClient commands, letting authenticated SSH users execute arbitrary commands on shell-based servers, exploit requires crafted path for shell parsing.
- 8.8 /10 HighCVE-2026-85731 No auth
oras-go - Path Traversal & Remote Code Execution
oras-go < 2.6.2 contains a path traversal caused by improper symlink resolution in OCI layer extraction, letting attackers overwrite arbitrary files and potentially execute code, exploit requires pulling a crafted artifact.
- 7.2 /10 HighCVE-2026-85569 Auth required
Tutor LMS WordPress plugin - Broken Access Control
Tutor LMS WordPress plugin < 4.0.8 contains a broken access control vulnerability caused by improper permission enforcement in its REST API, letting attackers with read-only API keys act as administrators, exploit requires possession of a read-only API key.
- 8.1 /10 HighCVE-2026-85530 No auth
GiveWP WordPress plugin - Authentication Bypass
GiveWP WordPress plugin < 4.16.8.1 contains a broken authentication caused by inconsistent normalization of donor email addresses, letting unauthenticated users reset passwords of linked user accounts including administrators, exploit requires crafted requests.
- 8.0 /10 HighCVE-2026-85469
quay-builder-qemu - Command Injection
quay-builder-qemu contains a code injection vulnerability caused by using a mutable branch in the pinned upstream Noelware/docker-manifest-action in the release workflow, letting remote attackers inject arbitrary code, exploit requires compromise of the mutable branch.