High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 461 of 556
- 7.8 /10 HighCVE-2026-82430 Auth required
Apache Storm - Command Injection
Apache Storm contains a command injection caused by improper validation and ownership change timing in the worker-launcher command file handling, letting attackers launch root-equivalent containers or bind-mount arbitrary host paths, exploit requires tenant control over worker directory.
- 7.8 /10 HighCVE-2026-82429 Auth required
Apache Storm - Privilege Escalation
Apache Storm < 3.1.0 contains a privilege escalation caused by TOCTOU race condition in setuid-root worker-launcher binary using lchown and chmod on re-resolved paths, letting untrusted tenant escalate privileges by symlink attack, exploit requires running untrusted topology code on supervisor node.
- 8.8 /10 HighCVE-2026-82428 Auth required
Apache Storm - Remote Code Execution
Apache Storm before 3.1.0 contains a remote code execution vulnerability caused by predictable blob keys for dependency artifacts uploaded with `storm jar --artifacts`, letting a malicious user inject code into other tenants' topologies, exploit requires multi-tenant cluster and use of `--artifacts` feature.
- 7.8 /10 HighCVE-2026-82427 Auth required
Apache Storm - Path Traversal & Remote Code Execution
Apache Storm contains a path traversal vulnerability in topology.blobstore.map allowing submitters to manipulate symlink targets, letting attackers as supervisor user delete files and execute code as other OS users, exploit requires topology submission.
- 8.4 /10 HighCVE-2026-82049 No auth
CPython - Path Traversal
CPython <= 3.13 contains a symlink & hard link vulnerability in the tarfile module's data and extraction filters, letting attackers modify file metadata or expose file contents outside the extraction directory, exploit requires crafted archive.
- 7.1 /10 HighCVE-2026-82035 No auth
PyMuPDF - Path Traversal
PyMuPDF <= 1.28.2 contains a path traversal vulnerability caused by improper sanitization of BaseFont names in extract_objects() font branch, letting attackers write arbitrary files outside the output directory, exploit requires crafted document input.
- 8.8 /10 HighCVE-2026-82028 Auth required
Magistrala - SQL Injection
Magistrala < 1.0.0 contains a SQL injection caused by unsafe interpolation of the format query parameter in timescale-reader and postgres-reader HTTP API services, letting authenticated attackers execute arbitrary SQL with superuser privileges.
- 8.1 /10 HighCVE-2026-81902 No auth
Concrete CMS - Cross-Site Request Forgery
Concrete CMS 9 through 9.5.2 contains a cross-site request forgery caused by missing CSRF token validation in the orphaned block removal panel action, letting remote attackers delete page blocks via an authenticated user with edit permissions.
- 8.7 /10 HighCVE-2026-81901 Auth required
Concrete CMS - Stored XSS
Concrete CMS 9.2.0 through 9.5.2 contains a stored XSS caused by missing authorization checks on page properties, templates, and types in the REST API page update endpoint, letting users with content-editing rights persist JavaScript executing in visitors' browsers, exploit requires user with content-editing rights.
- 7.5 /10 HighCVE-2026-78336 No auth
Apache Syncope - Information Disclosure
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an information disclosure caused by returning OIDC provider configurations including client secrets to any authenticated user, letting attackers access sensitive configuration data, exploit requires authentication.
- 7.5 /10 HighCVE-2026-76442
CVE-2026-76442
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76442 are related to issues with improper validation of specified quantity in input that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-1284.
- 7.7 /10 HighCVE-2026-73496 Auth required
MCP Atlassian - Path Traversal
MCP Atlassian < 0.22.0 contains a path traversal caused by unconfined client-controlled file_path in upload_attachment functions, letting remote attackers with write-tool access disclose server files and sensitive data, exploit requires write-tool access.
- 7.4 /10 HighCVE-2026-73494
Blaze - Authorization Bypass & Cache Poisoning
Blaze Scala library < 0.23.18 and 1.0.0-M1 to < 1.0.0-M42 contains an HTTP/1.1 parsing vulnerability caused by lax header and request boundary validation in Http1ServerParser, letting attackers cause authorization bypass or cache poisoning, exploit requires a pair of disagreeing parsers.
- 7.5 /10 HighCVE-2026-73236 No auth
Apache Syncope - Broken Access Control
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by improper realm prefix matching in delegated administration, letting attackers gain unauthorized access, exploit requires crafted realm names.
- 7.3 /10 HighCVE-2026-73195 Auth required
Apache Syncope - CSV Injection
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a CSV injection caused by improper encoding or escaping of output in CSV export, letting authenticated users execute spreadsheet formulas, exploit requires user authentication.