High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 633 of 725
- 7.5 /10 HighCVE-2026-65342 No auth
Apple macOS - Broken Access Control
Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a broken access control caused by insufficient validation, letting applications access sensitive user data, exploit requires app execution.
- 7.8 /10 HighCVE-2026-64790 No auth
Apple macOS - Broken Access Control
Apple macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 contain a broken access control caused by a path handling issue due to insufficient validation, letting apps gain elevated privileges, exploit requires app execution.
- 7.5 /10 HighCVE-2026-64761 No auth
Apple iOS & iPadOS - Information Disclosure
Apple iOS 27 and iPadOS 27 contain an information disclosure vulnerability caused by improper handling of user preferences, letting apps identify other installed apps, exploit requires app installation.
- 7.3 /10 HighCVE-2026-64752 Auth required
Apple - Buffer Overflow
Apple iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 contain a buffer overflow caused by processing a maliciously crafted image, letting attackers execute arbitrary code, exploit requires crafted image input.
- 7.1 /10 HighCVE-2026-64736 Auth required
Apple iOS & macOS - Out of Bounds Read/Write
Apple iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27 contain an out-of-bounds read/write caused by insufficient bounds checking, letting apps cause system termination or kernel memory corruption, exploit requires malicious app.
- 7.8 /10 HighCVE-2026-64712 Auth required
Apple macOS - Privilege Escalation
Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a privilege escalation caused by insufficient privilege checks, letting local apps gain root privileges, exploit requires local app execution.
- 7.8 /10 HighCVE-2026-64701 Auth required
Apple macOS - Privilege Escalation
Apple macOS Sequoia 15.7.8 and macOS Tahoe 26.6 contain a privilege escalation caused by insufficient permission restrictions, letting malicious apps gain root privileges, exploit requires malicious app execution.
- 8.8 /10 HighCVE-2026-61701 Auth required
Laravel MagicLink - Remote Code Execution
Laravel MagicLink 2.0.0 to 2.25.1 contains an insecure deserialization vulnerability caused by unsafe unserialize() fallback in magic_links.action column, letting attackers with database write access execute arbitrary code, exploit requires database record manipulation.
- 7.5 /10 HighCVE-2026-59960
Argos JavaScript - Command Injection
Argos JavaScript core package < 6.2.1 contains a command injection caused by untrusted CI branch or ref values interpolated into execSync() shell commands, letting attackers execute arbitrary commands with CI runner privileges, exploit requires attacker-controlled CI branch or ref.
- 7.5 /10 HighCVE-2026-59570
Zscaler Client Connector - Denial of Service
Zscaler Client Connector contains a denial of service caused by a pre-installed peer app tearing down the Zscaler tunnel, letting attackers force user logout and toggle packet capture, exploit requires pre-installed peer app.
- 8.1 /10 HighCVE-2026-59569 Auth required
Zscaler Client Connector - Authentication Bypass
Zscaler Client Connector on Android and ChromeOS contains an improper input validation vulnerability, letting attackers potentially bypass Zscaler controls, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-57579 No auth
Alchemy - Broken Access Control
Alchemy < 7.4.15, 8.0.15, 8.1.14, and 8.2.6 contains an information disclosure vulnerability caused by lack of authorization in the GET /api/pages/nested endpoint, letting unauthenticated attackers retrieve restricted and unpublished page metadata and content, exploit requires no authentication.
- 8.2 /10 HighCVE-2026-57132 No auth
PraisonAI - Authentication Bypass
PraisonAI < 4.6.62 contains an authentication bypass caused by disabled PRAISONAI_CALL_AUTH allowing unauthenticated requests to /api/v1/agents/{id}/invoke, letting attackers invoke registered agents and access private context without authentication.
- 8.1 /10 HighCVE-2026-57130 Auth required
PraisonAI praisonaiagents - Injection
PraisonAI praisonaiagents < 1.6.59 contains an IMAP injection caused by direct interpolation of LLM-controlled email fields into IMAP SEARCH criteria, letting agents with email credentials access, modify, delete mailbox data, or disrupt connections, exploit requires configured email credentials.
- 7.5 /10 HighCVE-2026-57129 No auth
PraisonAI praisonaiagents - Information Disclosure
PraisonAI praisonaiagents < 1.6.59 contains a file read vulnerability caused by lack of traversal, symlink, or workspace-boundary validation in MentionsParser._process_file_mention, letting attackers read arbitrary files accessible to the process, exploit requires crafted prompt input.