High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 638 of 725
- 8.1 /10 HighCVE-2026-16335 Auth required
IBM DataStage - Path Traversal
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers read, write, or delete arbitrary files, exploit requires authentication.
- 7.5 /10 HighCVE-2026-15955 No auth
IBM Db2 - Unrestricted File Upload
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain an unrestricted file write vulnerability caused by improper validation of file paths, letting remote attackers write arbitrary files, exploit requires network access.
- 8.8 /10 HighCVE-2026-13293 Auth required
IBM MQ - Insecure Deserialization
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote authenticated attackers execute arbitrary code on the system, exploit requires authentication.
- 7.1 /10 HighCVE-2026-13287 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an XML external entity injection caused by unsafe XML data processing, letting remote attackers expose sensitive information or consume memory resources, exploit requires crafted XML data.
- 7.1 /10 HighCVE-2026-13285 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contains an XML external entity injection caused by improper processing of XML data, letting remote attackers expose sensitive information or consume memory resources, exploit requires sending crafted XML data.
- 7.1 /10 HighCVE-2026-13275 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer contain an XML external entity injection caused by improper reply message processing, letting authenticated attackers read arbitrary files or perform server-side request forgery, exploit requires authentication.
- 7.5 /10 HighCVE-2026-13260 No auth
IBM Verify Identity Access - Denial of Service
IBM Verify Identity Access contains a denial of service vulnerability caused by insufficient validation of incoming request resources, letting remote attackers cause service disruption, exploit requires crafted requests.
- 7.1 /10 HighCVE-2026-13107 Auth required
IBM Business Automation Workflow - XML External Entity Injection
IBM Business Automation Workflow contains an XML External Entity Injection vulnerability caused by default use of programming model artifacts, letting attackers perform XML entity injection, exploit requires crafted XML input.
- 7.1 /10 HighCVE-2026-12756 Auth required
IBM Business Automation Workflow - XML External Entity Injection
IBM Business Automation Workflow contains an XML external entity injection caused by improper XML data processing, letting remote attackers expose sensitive information or consume memory resources, exploit requires crafted XML input.
- 7.3 /10 HighCVE-2024-58383 Auth required
Froxlor - Broken Access Control
Froxlor <= 2.2.0-rc3 contains an information disclosure vulnerability caused by insecure file permissions on /etc/pure-ftpd/db/mysql.conf, letting unprivileged local users read database credentials, exploit requires pure-ftpd usage and local code execution.
- 8.8 /10 HighCVE-2023-50461 Auth required
TYPO3 Direct Mail - Configuration Injection & Arbitrary Code Execution
TYPO3 Direct Mail extension through 9.5.1 contains a configuration injection caused by arbitrary TSConfig page write in the Configuration backend module, letting authenticated backend users inject configuration or execute code, exploit requires valid backend user access.
- 8.8 /10 HighCVE-2023-46273 Auth required
Extreme Networks IQ Engine - Buffer Overflow
Extreme Networks IQ Engine before 10.6r1a and 10.6r4 before 10.6r5 contains a buffer overflow caused by ah_event_send in ah_bgd, letting attackers cause memory corruption or remote code execution, exploit requires crafted input.
- 8.6 /10 HighCVE-2023-45858 No auth
Paessler PRTG - Path Traversal
Paessler PRTG < 23.4.88.1429 contains a path traversal caused by improper input validation, letting attackers read local files remotely, exploit requires network access.
- 7.5 /10 HighCVE-2023-32803 No auth
Amazon Linux 2 ca-certificates - Misconfiguration
Amazon Linux 2 ca-certificates package < 2021.2.50-72 contains a trust store misconfiguration caused by improper removal of certain TrustCor root certificates, letting attackers potentially trust malicious certificates, exploit requires vulnerable root store.
- 7.2 /10 HighCVE-2023-28148 No auth
Paessler PRTG - Stored XSS
Paessler PRTG < 23.3.86.1520 contains a stored XSS caused by improper sanitization of bodyclass input, letting remote attackers execute scripts in users' browsers, exploit requires user interaction.