High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 488 of 552
- 8.5 /10 HighCVE-2026-70341 Auth required
Microsoft Edge - Remote Code Execution
Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows authorized attackers to execute code remotely over a network, exploit requires attacker authorization.
- 7.5 /10 HighCVE-2026-68497 No auth
Jackson-databind - Denial of Service
Jackson-databind 2.0.0 < 2.18.10, 2.19.0 < 2.21.6, 2.22.0 < 2.22.2, 3.0.0 < 3.1.6, and 3.2.0 < 3.2.2 contains a denial of service caused by unbounded numeric string parsing in XML datatype deserializers, letting unauthenticated attackers exhaust CPU resources via crafted JSON input, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-67211 No auth
Apache OpenNLP - Denial of Service
Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 contain a denial of service caused by unbounded map pre-sizing in SymSpellModelSerializer.create() when reading attacker-controlled count fields from a binary model, letting attackers exhaust heap memory, exploit requires loading untrusted SymSpell model files.
- 7.6 /10 HighCVE-2026-62112 Auth required
Amelia - SQL Injection
Amelia <= 2.4.9 contains a SQL injection caused by improper input sanitization in the editor component, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.6 /10 HighCVE-2026-62109 Auth required
Sky Addons for Elementor - SQL Injection
Sky Addons for Elementor <= 3.8.4 contains a SQL injection caused by improper input sanitization in the editor component, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-62107 Auth required
Masteriyo - LMS - Remote Code Execution
Masteriyo - LMS <= 3.4.0 contains an unauthenticated PHP object injection caused by improper handling of user input, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-62106 Auth required
SMS Alert Order Notifications - Privilege Escalation
SMS Alert Order Notifications <= 3.9.9 contains a privilege escalation caused by improper access control, letting subscribers escalate their privileges, exploit requires subscriber access.
- 8.8 /10 HighCVE-2026-62102 Auth required
Gato GraphQL - Privilege Escalation
Gato GraphQL <= 19.2.3 contains a privilege escalation caused by improper subscriber privilege management, letting attackers escalate their privileges, exploit requires subscriber access.
- 7.1 /10 HighCVE-2026-62089 Auth required
Pixar Labs Master Addons for Elementor - Broken Access Control
Pixar Labs Master Addons for Elementor <= 3.2.2 contains a broken access control vulnerability caused by missing authorization checks, letting attackers abuse privileges, exploit requires no special conditions.
- 7.0 /10 HighCVE-2026-57842 Auth required
NetBSD - Use After Free
NetBSD contains a use-after-free and double-free vulnerability caused by a missing return statement in msg_recv_copyin() within the COMPAT_NETBSD32 layer, letting local users trigger kernel panic or memory corruption by calling recvmsg() with specific msg_iovlen values.
- 7.4 /10 HighCVE-2026-54241 No auth
libde265 - Integer Overflow
libde265 < 1.1.1 contains an integer overflow caused by signed 32-bit arithmetic in sample adaptive offset input-buffer size calculation, letting attackers cause out-of-bounds heap read or crash the decoder, exploit requires crafted HEVC stream.
- 7.4 /10 HighCVE-2026-54240 No auth
libde265 - Integer Overflow
libde265 < 1.1.1 contains an integer overflow caused by signed 32-bit arithmetic in pixel offset calculations, letting attackers trigger out-of-bounds heap reads or writes, exploit requires crafted HEVC stream with large image dimensions.
- 8.3 /10 HighCVE-2026-54174
Melange Apko - Package Integrity Bypass
Melange < 0.50.4 and Apko < 1.2.9 contain a package tampering vulnerability caused by missing verification of data section hash in APK packages, letting attackers substitute arbitrary files via mirror compromise or MITM, exploit requires attacker to control package source.
- 7.1 /10 HighCVE-2026-54166 Auth required
Shelf - Server-Side Request Forgery
Shelf prior to version 1.20.3 contains a server-side request forgery caused by bypassing imageUrl validation in the Asset CSV Content Import feature, letting authenticated users with asset:import permission make arbitrary server requests, exploit requires authenticated user with asset:import permission.
- 7.5 /10 HighCVE-2026-54135 No auth
AirSane - Denial of Service
AirSane < 0.4.12 contains a denial of service caused by improper validation of Content-Length header in the custom HTTP server, letting remote unauthenticated attackers crash the service via memory exhaustion.