High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 497 of 552

  • 8.8 /10 High
    CVE-2026-81551 Auth required

    IBM DataStage - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers write or delete files on shared storage.

  • 8.8 /10 High
    CVE-2026-81550 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.5 /10 High
    CVE-2026-81540 Auth required

    IBM DataStage - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal caused by improper validation of file paths, letting remote authenticated attackers overwrite ruleset files of other tenants.

  • 7.2 /10 High
    CVE-2026-81431 Auth required

    WooCommerce WordPress plugin - Broken Access Control

    WooCommerce WordPress plugin < 1.1.3 contains a broken access control vulnerability caused by improper validation of registration forms, letting users with post creation privileges register accounts with arbitrary roles including Administrator, exploit requires user with Contributor or higher privileges.

  • 8.1 /10 High
    CVE-2026-81268 Auth required

    IBM Langflow OSS - Authentication Bypass

    IBM Langflow OSS 1.0.0 through 1.11.5 contains an authentication bypass caused by insufficient session expiration of API keys after user deactivation, letting remote authenticated attackers execute flows and obtain sensitive information.

  • 7.5 /10 High
    CVE-2026-81265

    CVE-2026-81265

    IBM Langflow OSS 1.0.0 through 1.11.5.

  • 8.6 /10 High
    CVE-2026-81213 No auth

    IBM Langflow OSS - Information Disclosure

    IBM Langflow OSS 1.0.0 through 1.11.5 contains an information disclosure vulnerability caused by improper validation of user-supplied URLs, letting remote attackers obtain sensitive information from internal network resources, exploit requires crafted URL input.

  • 8.8 /10 High
    CVE-2026-81211 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a remote code execution caused by improper authorization of custom components in stored flows, letting remote authenticated attackers execute arbitrary Python code.

  • 7.7 /10 High
    CVE-2026-81210

    IBM DataStage - Broken Access Control

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an insecure direct object reference and path traversal caused by concatenation of caller-supplied strings into a String.format path on shared /ds-storage RWX PVC, letting attackers read sensitive job log files, exploit requires access to the shared PVC.

  • 8.5 /10 High
    CVE-2026-81207 Auth required

    IBM DataStage - Server Side Request Forgery

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a server-side request forgery caused by allowing any authenticated tenant to control outbound fetch parameters, letting attackers reflect WSDL responses and access internal services, exploit requires authentication without project membership.

  • 8.5 /10 High
    CVE-2026-80436 Auth required

    IBM DataStage on Cloud Pak for Data - Denial of Service

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a denial of service caused by improper authorization allowing remote authenticated attackers to delete arbitrary RabbitMQ queues or exchanges, exploit requires authentication.

  • 7.4 /10 High
    CVE-2026-80434 Auth required

    IBM DataStage on Cloud Pak for Data - Broken Access Control

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a broken access control caused by insecure direct object reference in runtime caches, letting remote authenticated attackers cause denial of service.

  • 7.1 /10 High
    CVE-2026-80380 No auth

    IBM DataStage - Cross-Site Request Forgery

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a cross-site request forgery caused by insufficient request validation, letting remote attackers perform unauthorized actions, exploit requires victim interaction.

  • 8.5 /10 High
    CVE-2026-80378 Auth required

    IBM DataStage - Denial of Service

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a denial of service vulnerability caused by improper authorization, letting remote authenticated attackers cause service disruption, exploit requires authentication.

  • 8.1 /10 High
    CVE-2026-80354 Auth required

    Apache Camel K - Authorization Bypass

    Apache Camel K 2.0.0 < 2.9.3, 2.10.1 < 2.10.2 contains an authorization bypass caused by user-controlled key in custom resource resolution, letting tenants access secrets of other tenants or operator components, exploit requires tenant access.