High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 451 of 556
- 7.5 /10 HighCVE-2026-55178
GeoLens - Broken Access Control
GeoLens prior to 1.2.3 contains a broken access control vulnerability caused by insufficient authorization checks on related datasets and API endpoints, letting anonymous and authenticated users access private dataset metadata and data, exploit requires crafted API requests referencing private datasets.
- 7.5 /10 HighCVE-2026-55149 No auth
Vouch Proxy - Denial of Service
Vouch Proxy < 0.48.0 contains a denial of service caused by unbounded allocation from attacker-controlled multipart cookie name in cookie parsing, letting remote attackers crash the authentication proxy without valid session, exploit requires no authentication.
- 8.3 /10 HighCVE-2026-54549
Meta Ads MCP - Server-Side Request Forgery
Meta Ads MCP < 1.0.115 contains a server-side request forgery caused by unvalidated image_url passed to HTTP client with follow_redirects enabled, letting network attackers access internal services, exploit requires network access with any non-empty authorization.
- 7.4 /10 HighCVE-2026-54547
Meta Ads MCP - Broken Access Control
Meta Ads MCP < 1.0.115 contains a broken access control vulnerability caused by improper authentication token validation in AuthInjectionMiddleware, letting network attackers execute MCP tools with operator's Meta credentials, exploit requires use of streamable-http transport and presence of META_ACCESS_TOKEN.
- 7.2 /10 HighCVE-2026-54544 No auth
Fireshare - Server Side Request Forgery
Fireshare < 1.6.16 contains a server-side request forgery caused by missing @login_required decorator on POST /api/test-discord-webhook and /api/test-webhook endpoints, letting unauthenticated attackers trigger arbitrary HTTP POST requests.
- 8.2 /10 HighCVE-2026-54167 No auth
Pipelines-as-Code - Authentication Bypass
Pipelines-as-Code < 0.37.8, 0.39.6, 0.42.1, and 0.48.0 contains a broken authentication caused by accepting X-GitHub-Enterprise-Host header before webhook signature validation, letting unauthenticated attackers obtain signed GitHub App JWTs, exploit requires network access to webhook endpoint.
- 7.1 /10 HighCVE-2026-54077 Auth required
ArcadeDB - Server Side Request Forgery & File Read
ArcadeDB prior to 26.6.1 contains a server-side request forgery and file read vulnerability caused by lack of validation in the IMPORT DATABASE statement, letting authenticated users with SQL command access read files or make internal requests, exploit requires authenticated SQL command access.
- 8.1 /10 HighCVE-2026-54076 Auth required
ArcadeDB - Broken Access Control
ArcadeDB prior to 26.6.1 contains a broken access control vulnerability caused by missing authorization checks on schema mutation methods, letting authenticated users without UPDATE_SCHEMA permission alter schema objects, exploit requires authenticated identity.
- 7.7 /10 HighCVE-2026-53957 Auth required
Contentful MCP Server - Authentication Bypass
Contentful MCP Server < 1.7.19 and MCP Tools < 0.4.5 contain an authorization token exposure caused by unvalidated host and proxy options in space migration tools, letting attackers redirect API requests and access tokens, exploit requires enabling migration tools and attacker-controlled content.
- 8.8 /10 HighCVE-2026-52484 Auth required
MitraStar GPT-2742GX4X5v6-SV - Command Injection
MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 contains a command injection caused by improper input handling in /cgi-bin/device-management-utilities-internet.cgi, letting authenticated attackers execute arbitrary code.
- 7.5 /10 HighCVE-2026-51134 No auth
C-MOR Video Surveillance - Path Traversal
C-MOR Video Surveillance up to 6.0104 contains a path traversal caused by improper validation of the 'cam' parameter in show-movies.pml, letting remote attackers access arbitrary files, exploit requires no special privileges.
- 8.5 /10 HighCVE-2026-45048 Auth required
Open Access Management (OpenAM) - Broken Access Control
Open Access Management (OpenAM) < 16.1.1 contains a broken access control vulnerability caused by lack of ownership and privilege checks in SessionRequestHandler, letting low-privileged authenticated users hijack other users' sessions, exploit requires authentication.
- 8.8 /10 HighCVE-2026-40058 Auth required
CrowdStrike Falcon - Local Privilege Escalation
CrowdStrike Falcon sensor for Windows (versions 7.34+, 7.32 LTS, 7.16 on Windows 7/2008 R2) contains an arbitrary file write vulnerability caused by Microsoft Office File Malicious Macro Removal policy enabled, letting unprivileged attackers escalate privileges locally, exploit requires the specific Windows policy enabled.
- 7.8 /10 HighCVE-2026-19886 No auth
OriginLab Origin Viewer - Remote Code Execution
OriginLab Origin Viewer contains a remote code execution vulnerability caused by improper validation in OGM file parsing, letting remote attackers execute arbitrary code, exploit requires user to open a malicious file or visit a malicious page.
- 7.8 /10 HighCVE-2026-19885 No auth
OriginLab Origin Viewer - Remote Code Execution
OriginLab Origin Viewer contains an out-of-bounds write caused by improper validation in OGWU file parsing, letting remote attackers execute arbitrary code, exploit requires user to open a malicious file or visit a malicious page.