High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 487 of 552
- 7.1 /10 HighCVE-2026-78807 Auth required
wpa_supplicant - Broken Access Control
wpa_supplicant < 2.12 contains a broken access control vulnerability caused by missing validation in the driver-based PMKSA selection path in wpa.c, letting local attackers bypass proper network context and AKMP matching for PMKSA caching, exploit requires local access.
- 8.4 /10 HighCVE-2026-7863 No auth
TUBITAK BILGEM Pardus Software - OS Command Injection
TUBITAK BILGEM Pardus Software < 1.0.5 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.
- 8.2 /10 HighCVE-2026-78224 No auth
XSLT Transformer Step - XML External Entity Injection
XSLT Transformer Step contains an XML External Entity (XXE) injection caused by insecure TransformerFactory configuration, letting attackers exfiltrate data and cause denial-of-service, exploit requires crafted XML input.
- 7.1 /10 HighCVE-2026-78134 Auth required
strongSwan - Broken Access Control
strongSwan 4.5.0 through 6.0.7 contains an incorrect access control vulnerability caused by missing or mismatched inner EAP identity in eap-ttls and eap-peap plugins, letting attackers bypass access restrictions, exploit requires crafted EAP messages.
- 7.5 /10 HighCVE-2026-78133 Auth required
strongSwan - Use After Free
strongSwan 6.0.0 through 6.0.7 contains a use-after-free caused by IKEv2 rekeying collision handling in libcharon, letting attackers cause memory corruption, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-78132 No auth
strongSwan - Denial of Service
strongSwan 5.1.3 through 6.0.7 contains a denial of service caused by an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax, letting attackers cause service disruption, exploit requires crafted certificate input.
- 7.5 /10 HighCVE-2026-78130 No auth
strongSwan - Denial of Service
strongSwan 4.2.0 through 6.0.7 contains a null pointer dereference caused by a flaw in the x509 plugin's attribute certificate parser, letting attackers cause denial of service, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-77807
AcyMailing WordPress Plugin - Path Traversal
AcyMailing WordPress plugin <= 11.0.4 contains a directory traversal caused by improper sanitization of the `user[name]` parameter, letting unauthenticated attackers read arbitrary files, exploit requires 'Embed images' option enabled.
- 7.2 /10 HighCVE-2026-74925 Auth required
MultiVendorX WordPress plugin - Broken Access Control
MultiVendorX WordPress plugin < 5.0.16 contains a broken access control vulnerability caused by lack of restrictions on role and capability updates, letting users with vendor role escalate to administrator privileges and take over the site, exploit requires user to have vendor role.
- 7.5 /10 HighCVE-2026-73785 No auth
HPE IceWall Federation Agent and Proxy - Denial of Service
HPE IceWall Federation Agent and Proxy contains a denial of service vulnerability that allows remote unauthenticated attackers to cause service disruption, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-73784 Auth required
HPE IceWall - Authentication Bypass
HPE IceWall contains a broken access control vulnerability caused by tampering of SAML response, letting attackers impersonate other users, exploit requires crafted SAML response.
- 7.5 /10 HighCVE-2026-72708 PoC publicNo auth
SPIP - SQL Injection
SPIP < 4.4.18 contains an unauthenticated blind SQL injection caused by improper escaping in spip_mysql_cite() for date columns in the public sitemap endpoint, letting attackers extract database content via crafted annee parameter.
- 7.5 /10 HighCVE-2026-71646 No auth
Robotics-STAR-Lab RACER - Denial of Service
Robotics-STAR-Lab RACER commit abcdef1234567890 contains a denial of service caused by improper handling in FastExplorationFSM::optTimerCallback() in swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp, letting attackers cause service disruption, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-71641 No auth
ZJU-FAST-Lab EGO-Planner-v2 - Denial of Service
ZJU-FAST-Lab EGO-Planner-v2 <= 5c99a95880401e2599638d567abc0e240396cb42 contains a denial of service caused by interaction issues between traj_server, poscmd_2_odom, and EGOReplanFSM emergency recovery logic, letting attackers cause service disruption remotely, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-71416
Headroom - Authentication Bypass
Headroom < 0.35.0 contains an authentication bypass caused by lack of Origin header validation in WebSocket requests, letting malicious WebSocket clients perform arbitrary LLM requests without authentication, exploit requires attacker to have access to Headroom proxy and OpenAI API key.