High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 452 of 556
- 7.8 /10 HighCVE-2026-19781 No auth
Ashlar-Vellum Cobalt - Remote Code Execution
Ashlar-Vellum Cobalt contains a heap-based buffer overflow caused by improper validation of user-supplied data length in VS file parsing, letting remote attackers execute arbitrary code, exploit requires user interaction.
- 8.8 /10 HighCVE-2026-19780 Auth required
Koha - Code Injection & Remote Code Execution
Koha contains a code injection vulnerability caused by improper validation of user-supplied strings passed to the eval function in the web service on TCP port 8081, letting authenticated attackers execute arbitrary code remotely.
- 7.1 /10 HighCVE-2026-19774 No auth
BlueZ - Remote Code Execution
BlueZ contains a stack-based buffer overflow caused by improper validation of user-supplied data length in the A2DP stream endpoints, letting network-adjacent attackers execute arbitrary code as root, exploit requires pairing a malicious Bluetooth device.
- 7.0 /10 HighCVE-2026-19515 No auth
WSO2 Integrator MI VS Code extension - Command Injection
WSO2 Integrator MI VS Code extension contains a command injection caused by improper sanitization of user input in Micro Integrator projects, letting attackers execute arbitrary OS commands via unit test execution, exploit requires workspace trust and test execution.
- 7.1 /10 HighCVE-2026-18424 Auth required
Concrete CMS - Server-Side Request Forgery
Concrete CMS 9.0.0 to 9.5.2 contains a server-side request forgery caused by cross-port reuse of a host's validated DNS pin in remote file import, letting low-privileged authenticated users access internal resources, exploit requires authenticated file import permission.
- 7.1 /10 HighCVE-2026-18423 Auth required
Concrete CMS - Broken Access Control
Concrete CMS 9.0.0 through 9.5.2 contains an insecure direct object reference (IDOR) caused by improper access control in Express saved search preset delete and edit dialogs, letting authenticated users with view permission delete or rename presets without proper authorization.
- 7.5 /10 HighCVE-2026-18110 PoC publicNo auth
Concrete CMS - Broken Access Control
Concrete CMS 9 (9.0.0 through 9.5.2) contains an information disclosure vulnerability caused by missing authorization checks on the user selector autocomplete endpoint, letting unauthenticated attackers enumerate backend user accounts, exploit requires no authentication.
- 8.3 /10 HighCVE-2026-1758 No auth
Secomea GateManager - Authentication Bypass
Secomea GateManager 11.4.625515072 and 11.5 contain a session fixation vulnerability caused by improper session management in the webserver module, letting attackers fixate user sessions, exploit requires victim to authenticate.
- 8.1 /10 HighCVE-2026-16141 No auth
OpenBMC phosphor-net-ipmid - Authentication Bypass
OpenBMC phosphor-net-ipmid contains a broken authentication caused by a logic flaw in RAKP Message 1 handler, letting unauthenticated clients bypass authentication using predictable keys, exploit requires unauthenticated network access.
- 8.8 /10 HighCVE-2026-16140 Auth required
OpenBMC phosphor-net-ipmid - Privilege Escalation
OpenBMC phosphor-net-ipmid contains a privilege escalation vulnerability caused by a logic flaw allowing session authorization context replacement without re-authentication, letting attackers escalate privileges.
- 8.8 /10 HighCVE-2026-14805 Auth required
Consulting WordPress Theme - Privilege Escalation
Consulting WordPress theme <= 6.7.16 contains a privilege escalation caused by improper capability checks and insecure transient authentication in admin AJAX endpoints, letting authenticated subscribers escalate to administrator via crafted URL.
- 8.3 /10 HighCVE-2026-13327
Devolutions Server - Man in the Middle
Devolutions Server <= 2026.2.16 contains an information disclosure vulnerability caused by improper certificate validation on LDAPS connections, letting network-positioned attackers intercept privileged directory service credentials via spoofed certificates, exploit requires network positioning.
- 7.7 /10 HighCVE-2026-13210 Auth required
GitLab CE/EE - Broken Access Control
GitLab CE/EE >= 15.7 and < 19.1.8, 19.2 and < 19.2.6, 19.3 and < 19.3.2 contain an information disclosure caused by improper input validation in the environment scope pattern matcher, letting authenticated users access CI/CD variables outside their intended environment scope, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-12752 Auth required
IBM Business Automation Workflow - XML External Entity Injection
IBM Business Automation Workflow contains an XML external entity injection caused by improper XML data processing, letting remote attackers expose sensitive information or consume memory resources, exploit requires crafted XML input.
- 8.8 /10 HighCVE-2026-12728 Auth required
IBM MQ - Remote Code Execution
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.