High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 578 of 628
- 8.2 /10 HighCVE-2026-87823 No auth
zstd-jni - Out of Bounds Read
zstd-jni before 1.5.7-14 contains a buffer overflow caused by 32-bit signed bounds checks on direct-ByteBuffer frame-size native methods, letting attackers read out-of-bounds memory, exploit requires crafted input with negative or overflowing offsets.
- 7.5 /10 HighCVE-2026-87822 No auth
t-digest - Denial of Service
t-digest 3.1 through 3.3 contains a denial of service caused by failure to validate centroid means during deserialization in MergingDigest.fromBytes, letting attackers inject NaN values that degrade sorting performance, exploit requires crafted serialized digests.
- 7.1 /10 HighCVE-2026-87821 Auth required
Lara Dashboard - Server-Side Request Forgery
Lara Dashboard <= 1.3.1 contains a server-side request forgery caused by lack of host validation and redirect restrictions in POST /api/admin/builder/markdown/fetch, letting authenticated users fetch arbitrary URLs and read responses.
- 7.5 /10 HighCVE-2026-87819 PoC publicNo auth
GitPython - Denial of Service
GitPython < 3.1.60 contains a regular expression denial of service caused by malformed author field processing in Actor.name_email_regex, letting attackers exhaust CPU resources, exploit requires crafted commit object.
- 8.8 /10 HighCVE-2026-87817 PoC publicNo auth
GitPython - Remote Code Execution
GitPython < 3.1.60 contains a code execution vulnerability caused by improper validation of git directory location using tracked files like gitdir, commondir, and HEAD, letting attackers execute arbitrary code when victims call index.commit() on cloned or opened repositories.
- 7.5 /10 HighCVE-2026-87816 No auth
PasswordPusher - Race Condition
PasswordPusher < 2.11.1 contains a race condition in view limit enforcement, letting unauthenticated attackers bypass expire_after_views limits by sending concurrent requests to the show endpoint.
- 8.7 /10 HighCVE-2026-87815 Auth required
SiYuan - Path Traversal
SiYuan < v3.8.2 contains a path traversal caused by improper validation of the deckID parameter in /api/riff/removeRiffDeck, letting authenticated administrators delete arbitrary .deck and .cards files outside the workspace directory.
- 7.3 /10 HighCVE-2026-87814 Auth required
SiYuan - Stored XSS
SiYuan < 3.8.2 contains a stored cross-site scripting vulnerability caused by failure to escape indexed asset content in the search asset preview feature, letting attackers execute JavaScript in the SiYuan origin, exploit requires attacker to place crafted text assets in a workspace.
- 7.3 /10 HighCVE-2026-87813 Auth required
SiYuan - Stored XSS
SiYuan < 3.8.2 contains a stored XSS caused by unescaped asset filenames in Search Assets result list, letting authenticated attackers execute JavaScript in victim browsers, exploit requires authentication.
- 7.3 /10 HighCVE-2026-87811 Auth required
SiYuan - Stored XSS
SiYuan < 3.8.2 contains a stored XSS caused by improper attribute encoding of persisted notebook template paths in HTML input value attributes, letting attackers execute JavaScript when victims open notebook configuration, exploit requires crafted malicious template paths.
- 7.5 /10 HighCVE-2026-87807 No auth
Siyuan - SQL Injection
Siyuan < v3.8.2 contains an authenticated SQL injection caused by improper sanitization of the method=1 query parameter in fullTextSearchBlock endpoint, letting authenticated attackers read sensitive document content by bypassing access controls.
- 7.4 /10 HighCVE-2026-87806 No auth
Parse Server - Authentication Bypass
Parse Server <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass caused by improper handling of zero-length passwords in the LDAP authentication adapter, letting unauthenticated attackers obtain valid session tokens, exploit requires LDAP authentication adapter enabled and directory allowing unauthenticated simple bind.
- 8.2 /10 HighCVE-2026-87795 No auth
zstd-jni - Out of Bounds Read
zstd-jni < 1.5.7-14 contains an out-of-bounds read caused by improper validation of offset and length parameters in ZstdDictCompress constructor, letting attackers read native heap memory, exploit requires supplying untrusted offset or length values.
- 8.4 /10 HighCVE-2026-87794 No auth
bestzip - Command Injection
bestzip 2.2.6 and 3.0.2 contain a command injection caused by argument injection in the nativeZip function, letting attackers execute arbitrary commands with Node.js process privileges, exploit requires crafted source entries and malicious destination path.
- 8.8 /10 HighCVE-2026-87766 Auth required
bubblewrap - Path Traversal
bubblewrap before 0.12.0 contains a path traversal caused by following parent symlinks via /oldroot during sandbox setup, letting attackers write files outside the sandbox as the launching user, exploit requires sandbox setup.