High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 655 of 725
- 7.2 /10 HighCVE-2026-89242 No auth
WWBN AVideo - Server Side Request Forgery
WWBN AVideo contains a server-side request forgery caused by lack of validation in the _json_decode function fetching remote URLs and local file paths, letting unauthenticated attackers read local files or access internal services via login.json.php.
- 8.6 /10 HighCVE-2026-89212 No auth
Akana API Platform - XML External Entity Injection
Akana API Platform <= 2026.1, 2025.1.1, and < 2024.1.6 contains an XML external entity injection caused by improper restriction of references during XML-to-JSON processing, letting attackers disclose sensitive information, exploit requires crafted XML input.
- 8.8 /10 HighCVE-2026-89178 No auth
Howyar Technologies WeenyGenius - Origin Validation Error
Howyar Technologies WeenyGenius contains an origin validation error vulnerability allowing unauthenticated attackers on the same network to spoof teacher workstations and send broadcast packets, causing student computers to connect to the attacker.
- 8.8 /10 HighCVE-2026-89177 No auth
Howyar Technologies WeenyGenius - Use of Insecure Protocol
Howyar Technologies WeenyGenius contains a use of insecure protocol caused by reliance on ZMTP Null mode, letting unauthenticated attackers on the same network capture packets or perform replay attacks, exploit requires network access.
- 8.8 /10 HighCVE-2026-89176 No auth
Howyar Technologies WeenyGenius - Authentication Bypass
Howyar Technologies WeenyGenius contains a missing authentication vulnerability allowing unauthenticated attackers on the same network to spoof student or teacher endpoints, letting attackers disrupt classroom operations or gain remote control, exploit requires network access.
- 7.5 /10 HighCVE-2026-89174 No auth
Kingdom Communication Associated Smart Video Intercom System - Authentication Bypass
Kingdom Communication Associated Smart Video Intercom System contains a missing brute-force protection vulnerability, letting unauthenticated remote attackers gain access to valid accounts through numerous login attempts, exploit requires no special privileges.
- 7.4 /10 HighCVE-2026-89161 No auth
PCRE2 - Use After Free
PCRE2 < 10.48 contains a use after free caused by mishandling a previously copied subject passed as context in pcre2_jit_match, letting attackers cause memory corruption, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-89147
Net-SNMP - Denial of Service
Net-SNMP through 5.9.5.2 contains a denial of service caused by unauthenticated blocking read without timeout in the SMUX module's smux_accept(), letting unauthenticated remote clients block SNMP processing indefinitely, exploit requires network access to SMUX listener.
- 7.5 /10 HighCVE-2026-89146
libp2p-rendezvous - Denial of Service
libp2p-rendezvous <= 0.17.1 contains a denial of service caused by failure to validate registration TTL values in discovery responses, letting malicious rendezvous servers trigger timer arithmetic overflow and crash client nodes, exploit requires interaction with a malicious server.
- 7.5 /10 HighCVE-2026-89099 Auth required
MongoDB Server - Race Condition
MongoDB Server contains a race condition caused by unsynchronized concurrent operations on internal memory in the document value layer, letting authenticated users with read-write privileges cause memory corruption and server termination, exploit requires authenticated user with read-write access.
- 7.8 /10 HighCVE-2026-89066
projen - Command Injection
projen < 0.103.0 contains a command injection caused by improper neutralization of shell metacharacters in project configuration and repository file names in task synthesis, letting attackers execute arbitrary OS commands, exploit requires crafted project configuration or repository files.
- 7.1 /10 HighCVE-2026-89065
projen - Path Traversal
projen < 0.101.37 contains a path traversal caused by crafted entries in the generated file manifest cleanup component, letting context-dependent attackers recursively delete writable files outside the project directory, exploit requires writable environment.
- 7.7 /10 HighCVE-2026-89060
multicluster-observability-addon - Broken Access Control
multicluster-observability-addon contains a broken access control vulnerability caused by managed-cluster identity referencing configuration resources outside its namespace, letting attacker-controlled managed clusters disclose sensitive hub Secrets, exploit requires attacker-controlled managed cluster.
- 7.5 /10 HighCVE-2026-89013 CISA KEVPoC publicNo auth
Dolibarr - Authorization Bypass
Dolibarr < 24.0.1 contains an authorization bypass caused by crafted 'hashp' parameter in document storage endpoints, letting unauthenticated attackers read arbitrary files including logs and backups, exploit requires crafted 'hashp' parameter.
- 7.5 /10 HighCVE-2026-87908 No auth
multiparty - Denial of Service
multiparty 2.1.0 < 4.3.1 contains a denial of service caused by unbounded memory usage while accumulating multipart part headers, letting unauthenticated attackers crash the server by sending large header volumes, exploit requires crafted request.