High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 569 of 628

  • 8.3 /10 High
    CVE-2026-88036 Auth required

    MongoDB C Driver - NoSQL Injection

    MongoDB C Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users access or delete unintended stored file content, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88034 Auth required

    MongoDB C++ Driver - NoSQL Injection

    MongoDB C++ Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users access or delete unintended stored file content, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88033 Auth required

    MongoDB Java Driver - NoSQL Injection

    MongoDB Java Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users access or modify unintended stored files, exploit requires authentication.

  • 8.1 /10 High
    CVE-2026-88031 Auth required

    MongoDB Go Driver - NoSQL Injection

    MongoDB Go Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users delete all GridFS file chunks, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88030 Auth required

    MongoDB Ruby Driver - NoSQL Injection

    MongoDB Ruby Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifiers, letting authenticated users access or delete unintended stored file content, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88029 Auth required

    MongoDB Python Driver - NoSQL Injection

    MongoDB Python Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier handling, letting authenticated users access or modify unintended stored files, exploit requires authentication.

  • 7.1 /10 High
    CVE-2026-88027 Auth required

    Laravel MongoDB - NoSQL Injection

    Laravel MongoDB integration contains a NoSQL injection caused by improper neutralization of special elements in embedded-document relation handling, letting authenticated users delete or overwrite embedded documents, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88025 Auth required

    MongoDB C# Driver - NoSQL Injection

    MongoDB C# Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users access or modify unintended stored files, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88024 Auth required

    MongoDB Rust Driver - NoSQL Injection

    MongoDB Rust Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users access or delete unintended stored files, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88023 Auth required

    MongoDB PHP Library - NoSQL Injection

    MongoDB PHP Library contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier handling, letting authenticated users access or modify unintended stored files, exploit requires authentication.

  • 7.7 /10 High
    CVE-2026-88022 No auth

    Laravel MongoDB - NoSQL Injection

    Laravel MongoDB integration contains a NoSQL injection caused by improper neutralization of special elements in query logic, letting attackers retrieve or delete unintended documents, exploit requires attacker to supply operator-shaped array.

  • 7.1 /10 High
    CVE-2026-88021

    Consul - Authorization Bypass

    Consul and Consul Enterprise contain an authorization bypass caused by improper escaping of characters in service names, namespaces, and partitions in Connect service mesh, letting unauthorized services access restricted destinations, exploit requires crafted service names.

  • 7.3 /10 High
    CVE-2026-88017 Auth required

    rclone - Broken Access Control

    rclone 1.64.0 to 1.75.1 contains a broken access control vulnerability caused by shared password storage in FTP auth-proxy driver, letting attackers with same username credentials access and modify another session's backend, exploit requires concurrent sessions with same username.

  • 7.1 /10 High
    CVE-2026-88016 Auth required

    rclone - Broken Access Control

    rclone < 1.75.1 contains a broken access control caused by symlink handling in backend/local with --links, letting attackers controlling source contents apply ownership, permissions, and timestamps outside destination, exploit requires --metadata flag for chmod and chown.

  • 8.1 /10 High
    CVE-2026-88011

    Traefik - Authentication Bypass

    Traefik < 2.11.56 and 3.0.0 to < 3.7.12 contains an identity spoofing vulnerability caused by client-supplied dot-form headers surviving ForwardAuth replacement and underscoreHeadersStrategy, letting attackers spoof identity headers, exploit requires backend normalization of headers.