High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 43 of 725
- 7.1 /10 HighCVE-2026-67187 No auth
Ninja Forms - CSV Injection
Ninja Forms plugin for WordPress < 3.15.4 contains a CSV injection caused by incomplete server-side validation in NF_Abstracts_List, letting unauthenticated attackers submit crafted payloads via nf_ajax_submit endpoint, exploit requires unauthenticated access.
- 8.6 /10 HighCVE-2026-67073 No auth
HCL BigFix AEX - Unrestricted File Upload & Broken Access Control
HCL BigFix AEX contains an unrestricted file upload and improper access control vulnerability, letting attackers upload malicious files and access sensitive uploaded content, exploit requires no special privileges.
- 7.4 /10 HighCVE-2026-6647 Auth required
WSO2 Identity Server - Access Control Bypass
WSO2 Identity Server with case-insensitive user store and case-sensitive identity database contains an access control bypass caused by inconsistent username case handling, letting attackers with valid tokens bypass token revocation, exploit requires valid access or refresh token with mixed-case username.
- 7.1 /10 HighCVE-2026-63286 PoC public
AXIS Camera Station Pro - Information Disclosure
AXIS Camera Station Pro contains an offline attack vulnerability caused by insecure database backups, letting attackers access sensitive backup data, exploit requires access to backup files.
- 8.6 /10 HighCVE-2026-61572 No auth
AVideo - Server Side Request Forgery
AVideo before 8.1.0 contains a server-side request forgery caused by insufficient URL validation and disabled TLS verification in url_get_contents, letting unauthenticated remote attackers read internal HTTP, HTTPS, and FTP services, exploit requires no authentication or user interaction.
- 7.3 /10 HighCVE-2026-61571 No auth
AVideo - Broken Access Control
AVideo prior to 8.1.0 contains broken access control caused by missing global authentication on encoder endpoints, letting unauthenticated attackers control queue processing, access streamer URLs, memory stats, and enumerate media files, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-61569
AVideo - SQL Injection
AVideo prior to 8.1.0 contains a SQL injection caused by improper sanitization and decoding of the 'user' parameter in Streamer::get, letting unauthenticated attackers read arbitrary database data, exploit requires attacker-hosted login response with specific flags.
- 8.8 /10 HighCVE-2026-61546 No auth
AnkiMCP - DNS Rebinding
AnkiMCP before 0.21.0 contains a DNS rebinding vulnerability caused by disabling FastMCP DNS-rebinding protection in mcp_server.py, letting remote attackers via malicious web pages read and modify local Anki data, exploit requires victim to visit a malicious web page while Anki is running.
- 8.6 /10 HighCVE-2026-61542 No auth
Gearboy Gearsystem - Authentication Bypass
Gearboy Gearsystem contains an insecure MCP HTTP mode caused by binding to INADDR_ANY and lack of authorization checks on MCP requests, letting remote attackers invoke emulator/debugging operations, exploit requires network access to MCP port.
- 7.3 /10 HighCVE-2026-6064 Auth required
Norton Antivirus, Avast Antivirus & AVG Internet Security - Privilege Escalation
Norton Antivirus, Avast Antivirus, and AVG Internet Security < 26.5.10933 on Windows contain a privilege escalation caused by arbitrary file/folder deletion during privileged shred operation, letting local low-privileged attackers escalate to SYSTEM.
- 8.3 /10 HighCVE-2026-59979 Auth required
YosemiteCrew - Broken Access Control
YosemiteCrew contains broken access control caused by missing organization and permission checks in service and PMS task-library/template routes, letting any authenticated or unauthenticated user modify or read other organizations' data, exploit requires no special privileges.
- 8.5 /10 HighCVE-2026-59185 Auth required
Identrail - Broken Access Control
Identrail < 1.0.2 contains an information disclosure caused by improper verification of GitHub installation ownership in the POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete endpoint, letting authenticated tenants access other customers' private repository data, exploit requires attacker to be an authenticated tenant with a legitimate connection.
- 8.3 /10 HighCVE-2026-59179 No auth
OpenHop @openhop/server - Path Traversal
OpenHop @openhop/server < 0.3.7 contains a path traversal vulnerability caused by lack of identifier allow-list in flow route parameters, letting attackers read or delete YAML files outside the flow directory, exploit requires network access to unauthenticated API endpoints.
- 8.8 /10 HighCVE-2026-59177 No auth
ESPHome Device Builder - Authentication Bypass
ESPHome Device Builder before version 1.0.10 binds the trusted Home Assistant ingress site to all interfaces, allowing unauthenticated clients with network access to the ingress port to access the dashboard without authentication.
- 7.8 /10 HighCVE-2026-59176 No auth
Functype - Command Injection
Functype < 1.4.4 contains a command injection caused by unconstrained version string interpolation in set_functype_version MCP tool, letting remote attackers execute arbitrary code via dynamic module import, exploit requires network access in certain deployments.