High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 450 of 556
- 8.1 /10 HighCVE-2026-56829 Auth required
Shopper - Broken Access Control
Shopper prior to 2.9.2 contains a broken access control vulnerability caused by missing authorization on stockAction() and mutable public $variant in Livewire component, letting authenticated admin-panel users with browse_products permission modify product variant stock quantities arbitrarily.
- 8.1 /10 HighCVE-2026-56827 Auth required
Shopper - Broken Access Control
Shopper < 2.9.2 contains a broken access control caused by missing server-side authorization in groupedBulkActions, letting browse-only staff users mass delete or change visibility of entities, exploit requires browse-only staff privileges.
- 8.1 /10 HighCVE-2026-56825 Auth required
Shopper - Broken Access Control
Shopper < 2.9.2 contains a broken access control caused by missing delete_collections authorization and lack of Livewire Locked attribute on Collection, letting authenticated staff users with browse_collections detach products or empty collections, exploit requires authenticated staff user with browse_collections permission.
- 7.5 /10 HighCVE-2026-55692 No auth
MediaWiki EmbedVideo Extension - Stored XSS
MediaWiki EmbedVideo Extension < 4.1.0 contains a stored XSS caused by improper escaping of JSON in data-mw-iframeconfig attribute, letting attackers with edit permissions execute JavaScript in wiki origin, exploit requires wiki page edit access.
- 8.6 /10 HighCVE-2026-55691 No auth
EmbedVideo MediaWiki - Stored XSS
EmbedVideo MediaWiki extension < 4.1.0 contains a stored XSS caused by unsanitized user-supplied class value passed to sprintf in EmbedHtmlFormatter::toHtml, letting authenticated wiki editors execute arbitrary JavaScript for page visitors.
- 7.5 /10 HighCVE-2026-55690 No auth
EmbedVideo Extension - Stored XSS
EmbedVideo Extension for MediaWiki < 4.1.0 contains a stored XSS caused by unneutralized attacker-controlled service name in exception text returned as HTML, letting users with edit privileges execute code in visitors' browsers, exploit requires wiki page edit access.
- 7.8 /10 HighCVE-2026-55359 Auth required
Multiple Locations - Broken Access Control
Multiple locations contain a permission bypass caused by logic errors in the code, letting local users escalate privileges, exploit requires user execution privileges.
- 7.8 /10 HighCVE-2026-55351 Auth required
VPU - Privilege Escalation
VPU contains an out-of-bounds write caused by an integer overflow, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.
- 8.0 /10 HighCVE-2026-55343 Auth required
ImsMediaAudioPlayer - Remote Code Execution
ImsMediaAudioPlayer contains an out-of-bounds write caused by missing bounds check in decodeAmr, letting remote attackers execute arbitrary code, exploit requires user interaction.
- 8.8 /10 HighCVE-2026-55331 Auth required
IP Multimedia Subsystem - Remote Code Execution
IP Multimedia Subsystem contains an out-of-bounds write caused by incorrect bounds check, letting remote attackers execute arbitrary code without additional privileges, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-55323 Auth required
gf_base - Privilege Escalation
gf_base contains a heap buffer overflow in gf_base_update_finger_base function in gf_base.c, letting local attackers escalate privileges via out-of-bounds write, exploit requires no additional privileges or user interaction.
- 8.8 /10 HighCVE-2026-55318 Auth required
Multiple Products - Use After Free
Multiple products contain a use-after-free vulnerability caused by a race condition, letting remote attackers execute arbitrary code without additional privileges, exploit requires no user interaction.
- 7.5 /10 HighCVE-2026-55306 No auth
Cellular Modem - Denial of Service
Cellular Modem contains a denial of service caused by improper input validation, letting remote attackers cause service disruption, exploit requires no special privileges or user interaction.
- 8.4 /10 HighCVE-2026-55301 No auth
Wave6 - Privilege Escalation
Wave6 contains an out-of-bounds write caused by missing bounds check in Wave6VpuDecFlush function, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 8.0 /10 HighCVE-2026-55225 Auth required
Strimzi - Broken Access Control
Strimzi <= 1.0.0 contains a broken access control vulnerability caused by improper handling of Kafka.spec.entityOperator watchedNamespace, letting attackers with Kafka custom resource creation permissions read or write Secrets in target namespaces, exploit requires ability to create Kafka custom resources.