High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 466 of 552
- 7.5 /10 HighCVE-2026-90778 No auth
SIPp - Buffer Overflow
SIPp <= 3.7.7 contains a buffer overflow caused by processing SIP To headers with tag parameters of 2049 bytes or more in get_peer_tag() function, letting unauthenticated remote attackers crash the process.
- 8.8 /10 HighCVE-2026-90777
ESPnet - Insecure Deserialization
ESPnet before 202609 contains an insecure deserialization vulnerability caused by torch.load with weights_only=False in pretrained model checkpoint loading, letting attackers execute arbitrary code via crafted checkpoint files, exploit requires loading malicious files.
- 7.5 /10 HighCVE-2026-90776 No auth
Nodemailer - Denial of Service
Nodemailer 9.1.0 through 10.0.4 contains a denial of service caused by quadratic time complexity in the addressparser component when parsing email addresses with RFC 5322 comments, letting attackers block the Node.js event loop, exploit requires crafted email headers.
- 7.5 /10 HighCVE-2026-90774 No auth
rustypaste - Path Traversal
rustypaste before 0.18.1 contains a path traversal caused by improper validation of the custom filename HTTP header, letting attackers write files outside the upload directory, exploit requires crafted HTTP requests.
- 7.6 /10 HighCVE-2026-90772
Amundsen frontend - Stored XSS
Amundsen frontend through 4.3.0 contains a stored XSS caused by rendering descriptions with dangerouslySetInnerHTML without sanitization in ResourceListItem components, letting attackers inject malicious scripts via metadata or Elasticsearch, exploit requires attacker to inject malicious markup.
- 8.8 /10 HighCVE-2026-90770 Auth required
Spug - Remote Code Execution
Spug 3.4.0 contains a remote code execution caused by unsanitized user input in the ping_check function, letting authenticated users with monitor permissions execute arbitrary commands via /monitor/run_test/ endpoint.
- 7.7 /10 HighCVE-2026-90769 Auth required
Open Notebook - Server Side Request Forgery
Open Notebook < 1.11.0 contains a server side request forgery caused by improper validation of URL parameter in POST /api/sources endpoint, letting authenticated users perform requests to internal services.
- 8.1 /10 HighCVE-2026-90768 Auth required
CAPEv2 - Broken Access Control
CAPEv2 through commit 471ee4b contains a broken access control caused by failure to validate task ownership in REST API endpoints, letting authenticated users read and delete analyses of other users, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-90678 No auth
HAProxy - HTTP Request Smuggling
HAProxy 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5 contain an HTTP request smuggling vulnerability caused by improper handling of HTTP/3 DATA frame lengths in chunked transfer coding on reused HTTP/1.1 backend connections, letting remote unauthenticated clients smuggle requests past frontend rules, exploit requires HTTP/3 frontend with QUIC support and specific backend conditions.
- 7.5 /10 HighCVE-2026-90668
UnrealIRCd - Denial of Service
UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 contains a denial of service caused by unlimited HTTP request headers in the webserver when websocket or JSON-RPC listener is enabled, letting remote attackers cause memory exhaustion and server unresponsiveness, exploit requires enabled websocket or JSON-RPC listener.
- 8.1 /10 HighCVE-2026-90651
Socket Firewall - Man-in-the-Middle
Socket Firewall before 2.0.0 contains a man-in-the-middle vulnerability caused by disabled TLS certificate verification in default configuration, letting attackers intercept and modify traffic between the firewall and upstream services, exploit requires attacker to intercept network traffic.
- 7.3 /10 HighCVE-2026-90603 No auth
Anil-matcha Open-Generative-AI - Unrestricted File Upload
Anil-matcha Open-Generative-AI <= 1.0.11/2.0.0 contains an unrestricted file upload caused by manipulation of the "x-proxy-target-url" argument in /api/upload-binary S3 Upload component, letting remote attackers upload arbitrary files, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-90601 No auth
getzep graphiti - Authentication Bypass
getzep graphiti <= 0.30.2 contains an authentication bypass caused by improper authentication in REST API component, letting remote attackers bypass authentication, exploit requires no special conditions.
- 7.3 /10 HighCVE-2026-90593 No auth
embedded-graphics - Integer Overflow
embedded-graphics <= 0.8.2 contains an integer overflow caused by manipulation of the "width" argument in ImageRaw::draw_sub_image function, letting remote attackers cause memory corruption or crash, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-90579 No auth
cheshire-cat-ai Cheshire Cat AI - Authentication Bypass
cheshire-cat-ai Cheshire Cat AI <= 1.9.2 contains an authentication bypass caused by manipulation of the user_id argument in _authorize_http_key function, letting remote attackers bypass authentication, exploit requires crafted user_id input.