High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 490 of 552
- 7.4 /10 HighCVE-2026-89043 No auth
passport-saml-encrypted - Authentication Bypass
passport-saml-encrypted <= 0.1.13 contains an XML signature wrapping vulnerability caused by independent XPath lookups without cross-validation in signature verification and assertion extraction, letting attackers with any valid signed SAML message bypass authentication, exploit requires attacker to hold a valid signed SAML message.
- 7.1 /10 HighCVE-2026-89011 No auth
isomorphic-git - Prototype Pollution
isomorphic-git < 1.42.0 contains a prototype pollution vulnerability caused by crafted ref names with '__proto__' path segments in getRemoteInfo, letting malicious Git server operators reroute network operations and leak credentials, exploit requires attacker-controlled Git server.
- 8.8 /10 HighCVE-2026-88959 Auth required
Anchor CMS - Broken Access Control
Anchor CMS <= 0.12.7 contains a broken access control vulnerability caused by failure to enforce role-based access control in admin user-management endpoints, letting authenticated low-privilege users create or modify administrator accounts, exploit requires authenticated user with editor or user role.
- 8.3 /10 HighCVE-2026-88939 Auth required
knowns - Broken Access Control
knowns through 0.33.0 contains a broken access control caused by exemption of project.set action from permission guard checks, letting attackers with read-only agent sessions bypass restrictions and gain write access, exploit requires read-only agent session.
- 8.8 /10 HighCVE-2026-88937 No auth
knowns - Path Traversal
knowns through 0.33.0 contains a path traversal caused by improper validation of template destination paths in the code generation template engine, letting attackers read and write arbitrary files outside the project root, exploit requires supplying malicious templates.
- 7.0 /10 HighCVE-2026-88924 Auth required
gvfs - Privilege Escalation
gvfs admin backend contains a TOCTOU race condition in gvfsd-admin daemon's chown() call on user-controlled directory pathnames, letting authenticated local attackers escalate privileges to root by modifying root-owned files.
- 7.2 /10 HighCVE-2026-88895 Auth required
CyberPanel - Authentication Bypass
CyberPanel < 3.0.5 contains a broken authentication caused by failure to enforce two-factor authentication on API endpoints, letting attackers with administrator passwords bypass TOTP and perform administrative actions without second factor.
- 7.5 /10 HighCVE-2026-88893 No auth
OpenPanel - Broken Access Control
OpenPanel contains an information disclosure caused by failure to validate access controls in share lookup procedures, letting unauthenticated attackers retrieve password hashes and report definitions via share links, exploit requires share link access.
- 8.3 /10 HighCVE-2026-88891 Auth required
OpenPanel - Broken Access Control
OpenPanel contains a broken access control caused by failure to enforce read-only project access on most mutating procedures, letting attackers with read-only access modify, delete, and publish project data, exploit requires explicit read-only access.
- 8.5 /10 HighCVE-2026-88890 Auth required
OpenPanel - SQL Injection
OpenPanel contains an SQL injection caused by improper validation of profile.* filter column identifiers in the analytics filter builder, letting authenticated attackers with project-scoped read or root export credentials bypass project isolation and access other organizations' analytics data and profile PII.
- 7.8 /10 HighCVE-2026-88889 Auth required
Renovate - Command Injection
Renovate < 44.14.7 contains a command injection caused by unescaped distributionType parameter in maven-wrapper.properties in Maven Wrapper manager, letting attackers execute arbitrary commands remotely during Maven Wrapper updates in binarySource=docker mode.
- 7.0 /10 HighCVE-2026-88888 Auth required
Renovate - Command Injection
Renovate < 44.14.7 contains a command injection caused by unescaped organization parameters in the Mix manager when processing private dependencies, letting attackers execute arbitrary commands as the Renovate user in docker mode.
- 8.6 /10 HighCVE-2026-88887 No auth
Renovate - Information Disclosure
Renovate contains a credential disclosure vulnerability caused by lack of same-origin verification in pagination URL handling for container registries, letting attackers with a malicious registry steal credentials, exploit requires interaction with malicious registry.
- 7.8 /10 HighCVE-2026-88886
Renovate - Command Injection
Renovate < 44.14.7 contains a command injection caused by unescaped distributionUrl in gradle-wrapper module, letting attackers execute arbitrary commands as Renovate user during Gradle Wrapper update, exploit requires self-hosted deployment with specific unsafe execution settings.
- 7.0 /10 HighCVE-2026-88885 Auth required
Renovate - Command Injection
Renovate < 44.14.7 contains a command injection caused by unescaped depName parameters in gomod manager import-path update commands with binarySource=docker, letting attackers execute arbitrary commands as Renovate user during Go module updates, exploit requires postUpdateOptions gomodUpdateImportPaths enabled.