High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 577 of 628
- 7.2 /10 HighCVE-2026-0310
Palo Alto Networks PAN-OS - Buffer Overflow
Palo Alto Networks PAN-OS contains a buffer overflow caused by improper XML processing, letting unauthenticated attackers with network access cause denial of service or execute arbitrary code with root privileges, exploit requires network access to management or dataplane interface.
- 7.5 /10 HighCVE-2025-57231 PoC publicNo auth
Docmost - Path Traversal
Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL.
- 7.1 /10 HighCVE-2026-87999 PoC publicAuth required
Open WebUI - Server Side Request Forgery
Open WebUI < 0.11.1 contains a server-side request forgery caused by improper validation of destination addresses in API endpoints, letting authenticated users fetch internal Azure platform content, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-87998 PoC publicAuth required
Open WebUI - Broken Access Control
Open WebUI 0.10.0 to 0.11.1 contains a broken access control vulnerability caused by missing administrator checks in DELETE /api/v1/knowledge/{id}/delete, letting non-administrator users with write access delete shared external connections, exploit requires write access to one external knowledge base.
- 7.7 /10 HighCVE-2026-87996 PoC publicAuth required
Open WebUI - Server Side Request Forgery
Open WebUI 0.9.6 to 0.11.1 contains an SSRF caused by inconsistent hostname validation in SafePlaywrightURLLoader, letting authenticated users with DNS control expose internal service responses, exploit requires authenticated user controlling DNS.
- 8.7 /10 HighCVE-2026-87995 PoC publicAuth required
Open WebUI - Stored XSS
Open WebUI 0.8.11 to 0.11.1 contains a stored XSS caused by rendering terminal port content in an iframe sandbox with allow-scripts and allow-same-origin, letting authenticated users with shared terminal access execute scripts and take over victim accounts, exploit requires victim to open the preview.
- 8.1 /10 HighCVE-2026-87930 PoC publicNo auth
MaxSite CMS - Insecure Deserialization
MaxSite CMS through 109.6 contains an insecure deserialization vulnerability caused by passing the ci_session cookie to unserialize() without class restrictions, letting unauthenticated attackers inject PHP objects and potentially execute code.
- 8.2 /10 HighCVE-2026-87927 No auth
MaxSite CMS - Local File Inclusion
MaxSite CMS <= 109.6 contains a local file inclusion vulnerability caused by base64-encoded path traversal sequences in ajax and require-maxsite dispatchers, letting unauthenticated attackers execute privileged handler files bypassing path validation.
- 7.3 /10 HighCVE-2026-87922 No auth
Rizwan17 inventory-management-system - Authentication Bypass
Rizwan17 inventory-management-system contains an authentication bypass caused by manipulation of the "userid" argument in DBOperation.addCategory of includes/process.php AJAX Backend, letting remote attackers bypass authentication, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-87921 No auth
Rizwan17 inventory-management-system - SQL Injection
Rizwan17 inventory-management-system contains a SQL injection caused by manipulation of update_category, cid, update_brand, or update_product arguments in includes/manage.php update_record function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.7 /10 HighCVE-2026-87877 No auth
zstd-jni - Use After Free
zstd-jni < 1.5.7-14 contains a use-after-free caused by failure to validate closed state in setDict, setLongMax, setLevel, and setRefMultipleDDicts methods, letting attackers corrupt memory or crash JVM by writing through freed pointers.
- 8.1 /10 HighCVE-2026-87874
community.general Ansible - Remote Code Execution
community.general Ansible collection memcached cache plugin contains an insecure deserialization vulnerability caused by unprotected pickle deserialization in python-memcached, letting remote attackers execute arbitrary code via crafted payloads on the Ansible controller, exploit requires network access to memcached instance.
- 7.5 /10 HighCVE-2026-87853
SSSD - Authentication Bypass
SSSD contains an authentication bypass caused by prefix comparison of OIDC subject identifiers in eval_access_token_buf(), letting attackers authenticate as other users with prefix IdP identifiers, exploit requires attacker to control IdP identifier.
- 7.7 /10 HighCVE-2026-87825 No auth
zstd-jni - Use After Free
zstd-jni < 1.5.7-14 contains a use-after-free vulnerability caused by dictionary shared lock being held only during load call, letting attackers cause silent data corruption or JVM crashes by closing dictionary while referenced.
- 7.5 /10 HighCVE-2026-87824 No auth
zstd-jni - Denial of Service
zstd-jni before 1.5.7-14 contains an out-of-bounds read caused by improper validation of samples buffer capacity in Zstd.trainFromBufferDirect, letting attackers cause JVM termination by supplying crafted sample lengths, exploit requires crafted input.