High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 465 of 552
- 7.1 /10 HighCVE-2026-13287 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an XML external entity injection caused by unsafe XML data processing, letting remote attackers expose sensitive information or consume memory resources, exploit requires crafted XML data.
- 7.1 /10 HighCVE-2026-13285 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contains an XML external entity injection caused by improper processing of XML data, letting remote attackers expose sensitive information or consume memory resources, exploit requires sending crafted XML data.
- 7.1 /10 HighCVE-2026-13275 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer contain an XML external entity injection caused by improper reply message processing, letting authenticated attackers read arbitrary files or perform server-side request forgery, exploit requires authentication.
- 7.5 /10 HighCVE-2026-13260 No auth
IBM Verify Identity Access - Denial of Service
IBM Verify Identity Access contains a denial of service vulnerability caused by insufficient validation of incoming request resources, letting remote attackers cause service disruption, exploit requires crafted requests.
- 7.1 /10 HighCVE-2026-13107 Auth required
IBM Business Automation Workflow - XML External Entity Injection
IBM Business Automation Workflow contains an XML External Entity Injection vulnerability caused by default use of programming model artifacts, letting attackers perform XML entity injection, exploit requires crafted XML input.
- 7.1 /10 HighCVE-2026-12756 Auth required
IBM Business Automation Workflow - XML External Entity Injection
IBM Business Automation Workflow contains an XML external entity injection caused by improper XML data processing, letting remote attackers expose sensitive information or consume memory resources, exploit requires crafted XML input.
- 7.3 /10 HighCVE-2024-58383 Auth required
Froxlor - Broken Access Control
Froxlor <= 2.2.0-rc3 contains an information disclosure vulnerability caused by insecure file permissions on /etc/pure-ftpd/db/mysql.conf, letting unprivileged local users read database credentials, exploit requires pure-ftpd usage and local code execution.
- 8.8 /10 HighCVE-2023-50461 Auth required
TYPO3 Direct Mail - Configuration Injection & Arbitrary Code Execution
TYPO3 Direct Mail extension through 9.5.1 contains a configuration injection caused by arbitrary TSConfig page write in the Configuration backend module, letting authenticated backend users inject configuration or execute code, exploit requires valid backend user access.
- 8.8 /10 HighCVE-2023-46273 Auth required
Extreme Networks IQ Engine - Buffer Overflow
Extreme Networks IQ Engine before 10.6r1a and 10.6r4 before 10.6r5 contains a buffer overflow caused by ah_event_send in ah_bgd, letting attackers cause memory corruption or remote code execution, exploit requires crafted input.
- 8.6 /10 HighCVE-2023-45858 No auth
Paessler PRTG - Path Traversal
Paessler PRTG < 23.4.88.1429 contains a path traversal caused by improper input validation, letting attackers read local files remotely, exploit requires network access.
- 7.5 /10 HighCVE-2023-32803 No auth
Amazon Linux 2 ca-certificates - Misconfiguration
Amazon Linux 2 ca-certificates package < 2021.2.50-72 contains a trust store misconfiguration caused by improper removal of certain TrustCor root certificates, letting attackers potentially trust malicious certificates, exploit requires vulnerable root store.
- 7.2 /10 HighCVE-2023-28148 No auth
Paessler PRTG - Stored XSS
Paessler PRTG < 23.3.86.1520 contains a stored XSS caused by improper sanitization of bodyclass input, letting remote attackers execute scripts in users' browsers, exploit requires user interaction.
- 7.8 /10 HighCVE-2026-90783 No auth
MKVToolNix - Remote Code Execution
MKVToolNix through 101.0 contains a heap buffer overflow caused by integer wraparound in 32-bit arithmetic in the avilib library's ODML superindex parser, letting attackers execute arbitrary code via crafted AVI files, exploit requires file parsing.
- 7.5 /10 HighCVE-2026-90780 No auth
SIPp - Buffer Overflow
SIPp <= 3.7.7 contains a buffer overflow caused by processing SIP messages with headers exceeding 20,490 bytes in get_header() function, letting unauthenticated remote attackers crash the process.
- 7.5 /10 HighCVE-2026-90779 No auth
SIPp - Denial of Service
SIPp <= 3.7.7 contains a buffer overflow caused by processing SIP authentication challenges with oversized algorithm parameters in createAuthHeader(), letting malicious SIP servers crash the client process, exploit requires interaction with crafted SIP challenges.