High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 570 of 628
- 8.2 /10 HighCVE-2026-88009 No auth
Traefik - Authorization Bypass
Traefik < 2.11.57 and < 3.7.13 contains a cross-vhost routing bypass caused by accepting rootless HTTP/1 request targets stored in URL.Opaque but forwarding them verbatim to backend, letting attackers bypass path-scoped authorization and access logging, exploit requires crafted HTTP/1 requests.
- 7.4 /10 HighCVE-2026-88004 No auth
Traefik - Broken Access Control
Traefik 3.2.0 to 3.7.13 contains a header spoofing vulnerability caused by improper inspection of HTTP trailers in entrypoint defenses, letting unauthenticated clients spoof identity or routing headers via chunked or HTTP/2 trailers.
- 7.7 /10 HighCVE-2026-87993 Auth required
Consul-template - Information Disclosure
Consul-template < 0.43.0 contains an information disclosure vulnerability caused by Vault secret values appearing in template error messages and logs, letting attackers access sensitive information, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-87962 No auth
t-digest - Denial of Service
t-digest 3.1 through 3.3 contains a denial of service caused by lack of validation of length and capacity fields in MergingDigest.fromBytes, letting attackers supply crafted serialized digests to abort parsing thread, exploit requires crafted serialized input.
- 7.1 /10 HighCVE-2026-87961 No auth
ESP32-audioI2S - Out of Bounds Read
ESP32-audioI2S 3.4.4 through 4.0.0 contains a heap-based out-of-bounds read caused by a shadowed length parameter in ID3 synchronized-lyrics processing in read_ID3_Header, letting attackers craft malicious MP3 files or HTTP audio streams to cause crashes or expose adjacent heap memory, exploit requires crafted audio input.
- 8.1 /10 HighCVE-2026-87958 Auth required
IBM Db2 - Denial of Service
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 contain a denial of service caused by privileged user disabling specific server functionality, letting privileged attackers disrupt service, exploit requires privileged access.
- 7.3 /10 HighCVE-2026-87933 No auth
DaveGamble cJSON - Use After Free
DaveGamble cJSON <= 1.7.19 contains a use after free vulnerability caused by improper handling in cJSONUtils_MergePatch function in cJSON_Utils.c, letting remote attackers cause memory corruption, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-87925 No auth
Rizwan17 inventory-management-system - SQL Injection
Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f contains a SQL injection caused by manipulation of the argument pro_name[] in storeCustomerOrderInvoice function in includes/manage.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-87803 Auth required
Countly Server - Authorization Bypass
Countly Server DBViewer contains an authorization bypass caused by flawed sub-pipeline detection in the aggregation stage sanitizer, letting non-admin users with read permission perform unauthorized cross-collection joins and access sensitive data, exploit requires DBViewer read permission.
- 8.3 /10 HighCVE-2026-87090 Auth required
Consul - Authorization Bypass
Consul and Consul Enterprise contain an authorization bypass caused by improper access control in the catalog node-write path, letting authenticated attackers delete other nodes' catalog registrations and take over node identities, exploit requires node-write permission and knowledge of target node ID.
- 7.5 /10 HighCVE-2026-86093
IBM Db2 - Command Injection
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a command injection caused by a stack-based buffer overflow in DRDA server endpoint handling, letting attackers execute arbitrary commands on clients, exploit requires control or impersonation of DRDA server endpoint.
- 7.1 /10 HighCVE-2026-85545 Auth required
HikCentral Access Control - Broken Access Control
HikCentral Access Control contains a broken access control vulnerability caused by authenticated low-privilege users invoking unauthorized API interfaces, letting attackers access restricted functions, exploit requires authenticated low-privilege user.
- 8.6 /10 HighCVE-2026-85217 No auth
Autodesk Fusion Desktop - Broken Access Control
Autodesk Fusion Desktop contains a broken access control vulnerability caused by a maliciously crafted add-in modifying persistent network proxy settings without user consent, letting attackers redirect authenticated network traffic, exploit requires add-in installation and execution.
- 8.8 /10 HighCVE-2026-84889 Auth required
IBM Langflow OSS - Remote Code Execution
IBM Langflow OSS 1.0.0 through 1.10.3 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting remote authenticated attackers execute arbitrary code.
- 7.5 /10 HighCVE-2026-84821 No auth
WP Fast Total Search - Broken Access Control
WP Fast Total Search <= 1.82.284 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources, exploit requires no authentication.