High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 49 of 552
- 8.3 /10 HighCVE-2026-93886 Auth required
IBM i - Stored XSS
IBM i 7.3, 7.4, 7.5, and 7.6 contain a stored XSS vulnerability caused by improper validation of user-supplied input, letting remote authenticated attackers execute arbitrary script code.
- 8.1 /10 HighCVE-2026-92922 Auth required
Adobe Commerce - Stored XSS
Adobe Commerce contains a stored XSS caused by insufficient input sanitization in form fields, letting high-privileged attackers inject malicious scripts executed in victim browsers, exploit requires high privileges.
- 8.7 /10 HighCVE-2026-92911 Auth required
Adobe Commerce - Stored XSS
Adobe Commerce contains a stored XSS caused by improper sanitization of form fields, letting low-privileged attackers inject malicious scripts executed in victim browsers, exploit requires low-privileged access.
- 7.2 /10 HighCVE-2026-92910 No auth
Adobe Commerce - Broken Access Control
Adobe Commerce contains an incorrect authorization vulnerability caused by flawed access control, letting attackers bypass security features to gain unauthorized read and limited write access, exploit requires no user interaction.
- 8.3 /10 HighCVE-2026-92908 Auth required
Adobe Commerce - Broken Access Control
Adobe Commerce contains an incorrect authorization vulnerability caused by flawed access control, letting low-privileged attackers bypass security features to gain unauthorized read and write access, exploit requires no user interaction.
- 8.7 /10 HighCVE-2026-92883 Auth required
GitLab CE/EE - Stored XSS
GitLab CE/EE >= 19.1, < 19.2.8, 19.3, < 19.3.5, and 19.4, < 19.4.2 contain a stored XSS caused by improper sanitization of HTML attributes in syntax-highlighted output, letting authenticated users execute arbitrary JavaScript in other users' browser sessions via specially crafted repositories.
- 8.6 /10 HighCVE-2026-92088 Auth required
upKeeper Solutions upKeeper Instant Privilege Access - Privilege Escalation
upKeeper Solutions upKeeper Instant Privilege Access <= 1.7.1 contains a privilege escalation caused by improper handling of undefined values, letting attackers escalate privileges, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-89201 Auth required
RUGGEDCOM CROSSBOW - SQL Injection
RUGGEDCOM CROSSBOW < V6.0 contains a SQL injection caused by improper validation of device group or facility names in Bulk Export workflow, letting authenticated attackers with specific privileges execute arbitrary SQL commands.
- 8.8 /10 HighCVE-2026-89199 Auth required
RUGGEDCOM CROSSBOW - Broken Access Control
RUGGEDCOM CROSSBOW < V6.0 contains a broken access control vulnerability caused by improper restriction of sensitive configuration access via database queries, letting authenticated attackers retrieve admin credentials, exploit requires authentication.
- 8.8 /10 HighCVE-2026-89198 Auth required
RUGGEDCOM CROSSBOW - SQL Injection
RUGGEDCOM CROSSBOW < V6.0 contains a SQL injection caused by improper validation of firmware file names, letting authenticated attackers with specific privileges execute arbitrary SQL commands.
- 8.8 /10 HighCVE-2026-89197 Auth required
RUGGEDCOM CROSSBOW - SQL Injection
RUGGEDCOM CROSSBOW < V6.0 contains a SQL injection caused by improper validation of the Value field in notification conditions during Notification Profile configuration, letting authenticated attackers with specific privileges execute arbitrary SQL commands.
- 8.8 /10 HighCVE-2026-89196 Auth required
RUGGEDCOM CROSSBOW - SQL Injection
RUGGEDCOM CROSSBOW < V6.0 contains a SQL injection caused by improper validation of facility names in Bulk Import/Export workflow, letting authenticated attackers with specific privileges execute arbitrary SQL commands.
- 7.1 /10 HighCVE-2026-89120 Auth required
SAP ABAP Platform - Authorization Bypass
SAP ABAP Platform contains an authorization bypass caused by a regression in session manager single transaction mode, letting low-privileged attackers bypass restrictions via crafted requests, exploit requires low privileges.
- 8.8 /10 HighCVE-2026-89113 Auth required
SAP Commerce Cloud - SQL Injection
SAP Commerce Cloud contains a SQL injection caused by insufficient validation of user-supplied input in database queries, letting authenticated users read, modify, or delete sensitive data, exploit requires authentication.
- 7.1 /10 HighCVE-2026-88964 Auth required
OpenVPN - Integer Underflow
OpenVPN 2.7_alpha3 through 2.7.7 on Windows and Android contains an integer underflow caused by crafted domain search options, letting remote authenticated servers cause denial of service or memory disclosure.