High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 635 of 725
- 8.1 /10 HighCVE-2026-54178 Auth required
Backpack/crud - Broken Access Control
Backpack/crud < 6.8.12 and < 7.0.35 contains an insecure file deletion vulnerability caused by trusting disk-relative paths from clear_<attribute>[] in HasUploadFields::uploadMultipleFilesToDisk, letting authenticated users with Update access delete arbitrary files on the configured disk, exploit requires authenticated Update access.
- 7.6 /10 HighCVE-2026-54175 Auth required
Backpack CRUD - Broken Access Control
Backpack CRUD < 6.8.11 and < 7.0.34 contains a broken access control caused by improper mass assignment in MyAccountController::postAccountInfoForm, letting authenticated attackers escalate privileges or take over accounts via crafted requests.
- 7.5 /10 HighCVE-2026-54156 No auth
node-opcua - Denial of Service
node-opcua prior to 2.166.0 contains a denial of service caused by unbounded nonce cache growth in server_secure_channel_layer.ts, letting unauthenticated remote attackers exhaust server memory, exploit requires repeated session creation with unique nonces.
- 7.7 /10 HighCVE-2026-54155
node-opcua - Authentication Bypass
node-opcua < 2.166.0 contains a broken authentication caused by improper verification of RSA-OAEP password blob and missing nonce binding in UserNameIdentityToken handler, letting unauthenticated remote attackers compromise accounts and replay tokens, exploit requires attacker to obtain server public key.
- 7.6 /10 HighCVE-2026-54087 Auth required
EasyAdmin - Stored XSS & Privilege Escalation
EasyAdmin 5.0.0 to 5.0.13 contains a stored XSS caused by browser-executable file uploads in FileField and ImageField without proper Content-Disposition headers, letting attackers execute JavaScript in authenticated admin's origin, exploit requires privilege gap between uploader and viewer.
- 7.5 /10 HighCVE-2026-53752 No auth
docx4j - Denial of Service
docx4j prior to 11.5.14 contains a denial of service caused by unbounded recursion in PropertyResolver due to cyclic w:basedOn style inheritance, letting attackers terminate worker threads, exploit requires processing untrusted DOCX files.
- 7.4 /10 HighCVE-2026-53714 No auth
Envoy Gateway - Authentication Bypass
Envoy Gateway < 1.7.4 and < 1.8.1 contains an authentication bypass caused by missing UnaryInterceptor and incomplete JWT validation in xDS gRPC server, letting attackers with network access retrieve sensitive configuration and TLS keys, exploit requires network access to port 18000.
- 7.5 /10 HighCVE-2026-53659 No auth
http4k - Denial of Service
http4k < 4.51.0.0, 5.42.0.0, and 6.49.0.0 contain a denial of service caused by unlimited gzip decompression size in ServerFilters.GZip and RequestFilters.GunZip, letting unauthenticated clients exhaust JVM heap, exploit requires sending crafted gzip request.
- 7.5 /10 HighCVE-2026-50276 No auth
Datadog dd-trace-rb - Denial of Service
Datadog dd-trace-rb < 2.32.0 contains a denial of service caused by lack of enforcement of baggage size limits during W3C baggage extraction, letting remote unauthenticated attackers cause unbounded CPU and memory consumption, exploit requires sending crafted baggage HTTP headers.
- 7.5 /10 HighCVE-2026-50270 No auth
Datadog dd-trace-java - Denial of Service
Datadog dd-trace-java < 1.62.0 contains a denial of service caused by lack of enforcement of baggage size limits during W3C baggage extraction, letting remote unauthenticated attackers cause unbounded CPU and memory consumption, exploit requires sending crafted baggage HTTP headers.
- 7.7 /10 HighCVE-2026-47701 Auth required
OpenTelemetry Operator - Information Disclosure
OpenTelemetry Operator < 0.152.0 contains an information disclosure caused by improper handling of ServiceMonitor bearerTokenFile in TargetAllocator, letting tenants with ServiceMonitor creation/update permissions disclose Collector service-account tokens, exploit requires Collector service-account token or sensitive file mounted and network access to target endpoint.
- 7.3 /10 HighCVE-2026-47253 Auth required
Anyquery - Path Traversal
Anyquery < 0.4.5 contains a path traversal caused by insufficient validation of the plugin parameter in clear_plugin_cache function, letting low-privileged bearer-token holders delete arbitrary writable directories, exploit requires bearer-token authentication.
- 8.8 /10 HighCVE-2026-43815
Apple macOS - Buffer Overflow
Apple macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6 contain a buffer overflow caused by insufficient bounds checking in AFPFS connection, letting attackers cause kernel memory corruption by connecting to a malicious AFPFS server, exploit requires attacker to control AFPFS server.
- 7.5 /10 HighCVE-2026-43789 No auth
Apple macOS - Information Disclosure
Apple macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 contain an information disclosure vulnerability caused by insufficient sandbox restrictions, letting apps access user-sensitive data, exploit requires app execution.
- 7.8 /10 HighCVE-2026-43786 PoC publicAuth required
Apple macOS - Privilege Escalation
Apple macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 contain a privilege escalation caused by missing entitlement checks, letting apps gain root privileges, exploit requires app execution.