High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 661 of 725
- 7.5 /10 HighCVE-2026-71646 No auth
Robotics-STAR-Lab RACER - Denial of Service
Robotics-STAR-Lab RACER commit abcdef1234567890 contains a denial of service caused by improper handling in FastExplorationFSM::optTimerCallback() in swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp, letting attackers cause service disruption, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-71641 No auth
ZJU-FAST-Lab EGO-Planner-v2 - Denial of Service
ZJU-FAST-Lab EGO-Planner-v2 <= 5c99a95880401e2599638d567abc0e240396cb42 contains a denial of service caused by interaction issues between traj_server, poscmd_2_odom, and EGOReplanFSM emergency recovery logic, letting attackers cause service disruption remotely, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-71416
Headroom - Authentication Bypass
Headroom < 0.35.0 contains an authentication bypass caused by lack of Origin header validation in WebSocket requests, letting malicious WebSocket clients perform arbitrary LLM requests without authentication, exploit requires attacker to have access to Headroom proxy and OpenAI API key.
- 8.5 /10 HighCVE-2026-70341 Auth required
Microsoft Edge - Remote Code Execution
Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows authorized attackers to execute code remotely over a network, exploit requires attacker authorization.
- 7.5 /10 HighCVE-2026-68497 No auth
Jackson-databind - Denial of Service
Jackson-databind 2.0.0 < 2.18.10, 2.19.0 < 2.21.6, 2.22.0 < 2.22.2, 3.0.0 < 3.1.6, and 3.2.0 < 3.2.2 contains a denial of service caused by unbounded numeric string parsing in XML datatype deserializers, letting unauthenticated attackers exhaust CPU resources via crafted JSON input, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-67211 No auth
Apache OpenNLP - Denial of Service
Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 contain a denial of service caused by unbounded map pre-sizing in SymSpellModelSerializer.create() when reading attacker-controlled count fields from a binary model, letting attackers exhaust heap memory, exploit requires loading untrusted SymSpell model files.
- 7.6 /10 HighCVE-2026-62112 Auth required
Amelia - SQL Injection
Amelia <= 2.4.9 contains a SQL injection caused by improper input sanitization in the editor component, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.6 /10 HighCVE-2026-62109 Auth required
Sky Addons for Elementor - SQL Injection
Sky Addons for Elementor <= 3.8.4 contains a SQL injection caused by improper input sanitization in the editor component, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-62107 Auth required
Masteriyo - LMS - Remote Code Execution
Masteriyo - LMS <= 3.4.0 contains an unauthenticated PHP object injection caused by improper handling of user input, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-62106 Auth required
SMS Alert Order Notifications - Privilege Escalation
SMS Alert Order Notifications <= 3.9.9 contains a privilege escalation caused by improper access control, letting subscribers escalate their privileges, exploit requires subscriber access.
- 8.8 /10 HighCVE-2026-62102 Auth required
Gato GraphQL - Privilege Escalation
Gato GraphQL <= 19.2.3 contains a privilege escalation caused by improper subscriber privilege management, letting attackers escalate their privileges, exploit requires subscriber access.
- 7.1 /10 HighCVE-2026-62089 Auth required
Pixar Labs Master Addons for Elementor - Broken Access Control
Pixar Labs Master Addons for Elementor <= 3.2.2 contains a broken access control vulnerability caused by missing authorization checks, letting attackers abuse privileges, exploit requires no special conditions.
- 7.0 /10 HighCVE-2026-57842 Auth required
NetBSD - Use After Free
NetBSD contains a use-after-free and double-free vulnerability caused by a missing return statement in msg_recv_copyin() within the COMPAT_NETBSD32 layer, letting local users trigger kernel panic or memory corruption by calling recvmsg() with specific msg_iovlen values.
- 7.4 /10 HighCVE-2026-54241 No auth
libde265 - Integer Overflow
libde265 < 1.1.1 contains an integer overflow caused by signed 32-bit arithmetic in sample adaptive offset input-buffer size calculation, letting attackers cause out-of-bounds heap read or crash the decoder, exploit requires crafted HEVC stream.
- 7.4 /10 HighCVE-2026-54240 No auth
libde265 - Integer Overflow
libde265 < 1.1.1 contains an integer overflow caused by signed 32-bit arithmetic in pixel offset calculations, letting attackers trigger out-of-bounds heap reads or writes, exploit requires crafted HEVC stream with large image dimensions.