High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 501 of 552
- 7.8 /10 HighCVE-2026-19136 No auth
Tianxi AI Agent PC Application - Command Injection
Tianxi AI Agent PC Application contains a command injection caused by handling of specially crafted links, letting local users execute arbitrary operating system commands, exploit requires local user interaction.
- 7.1 /10 HighCVE-2026-18994 Auth required
Lenovo File Manager - Broken Access Control
Lenovo File Manager Android Application contains an improper authorization vulnerability that allows a local authenticated user to read or modify protected files within the application, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-15019 No auth
WooCommerce Direct Download - Path Traversal
WooCommerce Direct Download plugin <= 1.19 contains a directory traversal vulnerability caused by insufficient validation in the top-level include function, letting unauthenticated attackers read arbitrary files on the server, exploit requires presence of at least one free, virtual, downloadable product.
- 8.0 /10 HighCVE-2026-14873 Auth required
Bulk Password Reset WordPress plugin - Privilege Escalation
Bulk Password Reset WordPress plugin <= 1.3.3 contains a privilege escalation via account takeover caused by improper user identity validation before updating user details, letting authenticated attackers with subscriber-level access change arbitrary user emails and reset passwords.
- 7.8 /10 HighCVE-2026-11813 Auth required
Lenovo Filez Client - Privilege Escalation
Lenovo Filez Client contains an improper permissions vulnerability that allows local authenticated users to escalate privileges by exploiting incorrect permission settings.
- 7.2 /10 HighCVE-2026-0310
Palo Alto Networks PAN-OS - Buffer Overflow
Palo Alto Networks PAN-OS contains a buffer overflow caused by improper XML processing, letting unauthenticated attackers with network access cause denial of service or execute arbitrary code with root privileges, exploit requires network access to management or dataplane interface.
- 7.5 /10 HighCVE-2025-57231 PoC publicNo auth
Docmost - Path Traversal
Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL.
- 7.1 /10 HighCVE-2026-87999 PoC publicAuth required
Open WebUI - Server Side Request Forgery
Open WebUI < 0.11.1 contains a server-side request forgery caused by improper validation of destination addresses in API endpoints, letting authenticated users fetch internal Azure platform content, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-87998 PoC publicAuth required
Open WebUI - Broken Access Control
Open WebUI 0.10.0 to 0.11.1 contains a broken access control vulnerability caused by missing administrator checks in DELETE /api/v1/knowledge/{id}/delete, letting non-administrator users with write access delete shared external connections, exploit requires write access to one external knowledge base.
- 7.7 /10 HighCVE-2026-87996 PoC publicAuth required
Open WebUI - Server Side Request Forgery
Open WebUI 0.9.6 to 0.11.1 contains an SSRF caused by inconsistent hostname validation in SafePlaywrightURLLoader, letting authenticated users with DNS control expose internal service responses, exploit requires authenticated user controlling DNS.
- 8.7 /10 HighCVE-2026-87995 PoC publicAuth required
Open WebUI - Stored XSS
Open WebUI 0.8.11 to 0.11.1 contains a stored XSS caused by rendering terminal port content in an iframe sandbox with allow-scripts and allow-same-origin, letting authenticated users with shared terminal access execute scripts and take over victim accounts, exploit requires victim to open the preview.
- 8.1 /10 HighCVE-2026-87930 PoC publicNo auth
MaxSite CMS - Insecure Deserialization
MaxSite CMS through 109.6 contains an insecure deserialization vulnerability caused by passing the ci_session cookie to unserialize() without class restrictions, letting unauthenticated attackers inject PHP objects and potentially execute code.
- 8.2 /10 HighCVE-2026-87927 No auth
MaxSite CMS - Local File Inclusion
MaxSite CMS <= 109.6 contains a local file inclusion vulnerability caused by base64-encoded path traversal sequences in ajax and require-maxsite dispatchers, letting unauthenticated attackers execute privileged handler files bypassing path validation.
- 7.3 /10 HighCVE-2026-87922 No auth
Rizwan17 inventory-management-system - Authentication Bypass
Rizwan17 inventory-management-system contains an authentication bypass caused by manipulation of the "userid" argument in DBOperation.addCategory of includes/process.php AJAX Backend, letting remote attackers bypass authentication, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-87921 No auth
Rizwan17 inventory-management-system - SQL Injection
Rizwan17 inventory-management-system contains a SQL injection caused by manipulation of update_category, cid, update_brand, or update_product arguments in includes/manage.php update_record function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.