High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 446 of 556
- 7.5 /10 HighCVE-2026-69218 No auth
Http4s - Denial of Service
Http4s prior to 0.23.35 and 1.0.0-M47 contains a denial of service caused by unbounded buffering of HTTP/2 header blocks in H2Connection, letting remote attackers exhaust heap memory, exploit requires sending incomplete header blocks.
- 8.7 /10 HighCVE-2026-69217 No auth
Http4s - HTTP Request Smuggling
Http4s prior to 0.23.35 and 1.0.0-M47 contains an HTTP request smuggling vulnerability caused by accepting differing duplicate Content-Length headers and using the last value, letting unauthenticated attackers bypass front-end controls and poison caches, exploit requires attacker to send crafted CL.CL requests.
- 7.5 /10 HighCVE-2026-69213 No auth
Http4s - Denial of Service
Http4s prior to 0.23.35 and 1.0.0-M47 contains a denial of service caused by unbounded queue exhaustion in Ember HTTP/2 frame serialization, letting unauthenticated HTTP/2 clients exhaust server heap memory, exploit requires network access to send frames.
- 7.5 /10 HighCVE-2026-69210 No auth
Http4s - Denial of Service
Http4s < 0.23.35 and < 1.0.0-M47 contain a denial of service caused by improper handling of negative 64-bit WebSocket frame lengths in FrameTranscoder.bodyLength, letting remote clients cause infinite decode loops and resource exhaustion, exploit requires completing a WebSocket handshake through Ember server.
- 7.5 /10 HighCVE-2026-69209 No auth
Http4s - Denial of Service
Http4s < 0.23.35 and < 1.0.0-M47 contain a denial of service caused by unbounded WebSocket message buffering in the shared decoder, letting remote clients exhaust server memory with oversized frames, exploit requires completing WebSocket handshake.
- 7.5 /10 HighCVE-2026-69208 No auth
Http4s - Denial of Service
Http4s < 0.23.35 and < 1.0.0-M47 contain a denial of service caused by inverted stale-nonce comparison in DigestAuth middleware, letting unauthenticated attackers exhaust JVM heap memory by triggering repeated authentication challenges.
- 8.7 /10 HighCVE-2026-69205 No auth
Http4s - Server Side Request Forgery
Http4s prior to 0.23.35 and 1.0.0-M47 contains a server-side request forgery caused by case-sensitive substring test and improper charset decoding in Ember's HeaderP.parse, letting attackers perform request smuggling and cache poisoning, exploit requires crafted HTTP requests.
- 7.5 /10 HighCVE-2026-69203 No auth
Http4s - Denial of Service
Http4s < 0.23.35 and < 1.0.0-M47 contain a denial of service caused by lack of enforcement of SETTINGS_MAX_CONCURRENT_STREAMS in HTTP/2, letting unauthenticated attackers exhaust heap memory by opening unlimited streams, exploit requires HTTP/2 enabled.
- 7.5 /10 HighCVE-2026-69202 No auth
Http4s - Denial of Service
Http4s prior to 0.23.35 and 1.0.0-M47 contains a denial of service caused by unbounded HTTP/2 flow-control window replenishment and unbounded per-stream data buffering, letting hostile peers exhaust heap memory, exploit requires HTTP/2 usage with ember-server or ember-client.
- 8.8 /10 HighCVE-2026-68950 No auth
Affected Products - Authentication Bypass
Affected products contain hardcoded credentials in the ftpd service, letting remote attackers run the service as root and gain root file access, exploit requires FTP service to be reachable.
- 8.8 /10 HighCVE-2026-68070 No auth
Affected products - Command Injection
Affected products contain a command injection caused by missing authentication for a critical function, letting attackers execute system commands as root, exploit requires missing authentication.
- 7.7 /10 HighCVE-2026-65831 Auth required
ArcadeDB - File Inclusion
ArcadeDB prior to 26.7.1 contains a file system read vulnerability caused by insufficient authorization enforcement in PolyglotQueryEngine and GraalPolyglotEngine allowing read-only users to read arbitrary host files, exploit requires reader-role user privileges.
- 8.3 /10 HighCVE-2026-63443 Auth required
Coder - Broken Access Control
Coder < 2.29.19, 2.32.9, 2.33.10, and 2.34.4 contains a broken access control caused by improper handling of HTTP redirects in agentConn.apiClient(), letting authenticated users redirect requests to other agents to read/write files and execute commands across workspace boundaries, exploit requires authenticated user controlling a modified workspace agent and knowledge of victim agent UUID.
- 8.1 /10 HighCVE-2026-61668
DIRAC - Remote Code Execution
DIRAC < 8.0.79, < 9.0.22, and < 9.1.10 contains a remote code execution caused by lack of TLS certificate verification in pilotWrapperScript during pilot.tar and checksum download, letting attackers with network interception capabilities execute arbitrary code with pilot proxy credentials, exploit requires network traffic interception or redirection.
- 7.5 /10 HighCVE-2026-61554 No auth
emp3r0r - Denial of Service
emp3r0r < 4.2.5 contains a denial of service caused by acceptance of attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication, letting remote unauthenticated attackers consume server resources, exploit requires no authentication.