High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 631 of 725
- 8.4 /10 HighCVE-2026-82049 No auth
CPython - Path Traversal
CPython <= 3.13 contains a symlink & hard link vulnerability in the tarfile module's data and extraction filters, letting attackers modify file metadata or expose file contents outside the extraction directory, exploit requires crafted archive.
- 7.1 /10 HighCVE-2026-82035 No auth
PyMuPDF - Path Traversal
PyMuPDF <= 1.28.2 contains a path traversal vulnerability caused by improper sanitization of BaseFont names in extract_objects() font branch, letting attackers write arbitrary files outside the output directory, exploit requires crafted document input.
- 8.8 /10 HighCVE-2026-82028 Auth required
Magistrala - SQL Injection
Magistrala < 1.0.0 contains a SQL injection caused by unsafe interpolation of the format query parameter in timescale-reader and postgres-reader HTTP API services, letting authenticated attackers execute arbitrary SQL with superuser privileges.
- 8.1 /10 HighCVE-2026-81902 No auth
Concrete CMS - Cross-Site Request Forgery
Concrete CMS 9 through 9.5.2 contains a cross-site request forgery caused by missing CSRF token validation in the orphaned block removal panel action, letting remote attackers delete page blocks via an authenticated user with edit permissions.
- 8.7 /10 HighCVE-2026-81901 Auth required
Concrete CMS - Stored XSS
Concrete CMS 9.2.0 through 9.5.2 contains a stored XSS caused by missing authorization checks on page properties, templates, and types in the REST API page update endpoint, letting users with content-editing rights persist JavaScript executing in visitors' browsers, exploit requires user with content-editing rights.
- 7.5 /10 HighCVE-2026-78336 No auth
Apache Syncope - Information Disclosure
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an information disclosure caused by returning OIDC provider configurations including client secrets to any authenticated user, letting attackers access sensitive configuration data, exploit requires authentication.
- 7.5 /10 HighCVE-2026-76442
CVE-2026-76442
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76442 are related to issues with improper validation of specified quantity in input that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-1284.
- 7.7 /10 HighCVE-2026-73496 Auth required
MCP Atlassian - Path Traversal
MCP Atlassian < 0.22.0 contains a path traversal caused by unconfined client-controlled file_path in upload_attachment functions, letting remote attackers with write-tool access disclose server files and sensitive data, exploit requires write-tool access.
- 7.4 /10 HighCVE-2026-73494
Blaze - Authorization Bypass & Cache Poisoning
Blaze Scala library < 0.23.18 and 1.0.0-M1 to < 1.0.0-M42 contains an HTTP/1.1 parsing vulnerability caused by lax header and request boundary validation in Http1ServerParser, letting attackers cause authorization bypass or cache poisoning, exploit requires a pair of disagreeing parsers.
- 7.5 /10 HighCVE-2026-73236 No auth
Apache Syncope - Broken Access Control
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by improper realm prefix matching in delegated administration, letting attackers gain unauthorized access, exploit requires crafted realm names.
- 7.3 /10 HighCVE-2026-73195 Auth required
Apache Syncope - CSV Injection
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a CSV injection caused by improper encoding or escaping of output in CSV export, letting authenticated users execute spreadsheet formulas, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-73178 No auth
Apache Syncope - Information Disclosure & Privilege Escalation
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an information disclosure vulnerability caused by administrator access to signed JWT access tokens via REST, letting administrators impersonate higher privileged users, exploit requires administrator entitlements.
- 8.8 /10 HighCVE-2026-72524 Auth required
Apache Doris - Broken Access Control
Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3 contain a broken access control vulnerability caused by incorrect authorization logic, letting authenticated users bypass privilege checks to access or modify unauthorized data, exploit requires user authentication.
- 7.4 /10 HighCVE-2026-70658
Pay - Authentication Bypass
Pay for Ruby on Rails < 11.6.2 contains a timing attack vulnerability caused by insecure comparison of HMAC signatures in PaddleBillingController, letting unauthenticated remote attackers forge accepted webhooks, exploit requires precise timing measurements.
- 7.8 /10 HighCVE-2026-68955
Rakuten Kobo Desktop Application - Remote Code Execution
Rakuten Kobo Desktop Application (Windows version) contains a DLL hijacking vulnerability caused by insecure loading of Dynamic Link Libraries during installation, letting attackers execute arbitrary code with user privileges, exploit requires crafted DLL in installer directory.