High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 663 of 725
- 7.3 /10 HighCVE-2026-89087 No auth
OCaml cstruct - Out of Bounds Read
OCaml cstruct before 6.3.0 contains an out of bounds read caused by mishandling indexes, letting attackers potentially cause denial of service or information disclosure, exploit requires crafted input.
- 8.2 /10 HighCVE-2026-89054 No auth
OpenNMS Horizon - Broken Access Control
OpenNMS Horizon contains a missing authorization vulnerability caused by lack of authorization enforcement on PATCH endpoints in /api/v2 REST API, letting unauthenticated attackers disable event and SNMP data collection, exploit requires attacker to access the web UI.
- 8.2 /10 HighCVE-2026-89046 No auth
zstd-jni - Out of Bounds Read
zstd-jni 1.5.5-6 through 1.5.7-13 contains an out-of-bounds read caused by lack of validation of negative srcPosition arguments in Zstd.getFrameContentSize, letting attackers cause information disclosure or JVM crashes, exploit requires crafted input with negative offset.
- 7.4 /10 HighCVE-2026-89043 No auth
passport-saml-encrypted - Authentication Bypass
passport-saml-encrypted <= 0.1.13 contains an XML signature wrapping vulnerability caused by independent XPath lookups without cross-validation in signature verification and assertion extraction, letting attackers with any valid signed SAML message bypass authentication, exploit requires attacker to hold a valid signed SAML message.
- 7.1 /10 HighCVE-2026-89011 No auth
isomorphic-git - Prototype Pollution
isomorphic-git < 1.42.0 contains a prototype pollution vulnerability caused by crafted ref names with '__proto__' path segments in getRemoteInfo, letting malicious Git server operators reroute network operations and leak credentials, exploit requires attacker-controlled Git server.
- 8.8 /10 HighCVE-2026-88959 Auth required
Anchor CMS - Broken Access Control
Anchor CMS <= 0.12.7 contains a broken access control vulnerability caused by failure to enforce role-based access control in admin user-management endpoints, letting authenticated low-privilege users create or modify administrator accounts, exploit requires authenticated user with editor or user role.
- 8.3 /10 HighCVE-2026-88939 Auth required
knowns - Broken Access Control
knowns through 0.33.0 contains a broken access control caused by exemption of project.set action from permission guard checks, letting attackers with read-only agent sessions bypass restrictions and gain write access, exploit requires read-only agent session.
- 8.8 /10 HighCVE-2026-88937 No auth
knowns - Path Traversal
knowns through 0.33.0 contains a path traversal caused by improper validation of template destination paths in the code generation template engine, letting attackers read and write arbitrary files outside the project root, exploit requires supplying malicious templates.
- 7.0 /10 HighCVE-2026-88924 Auth required
gvfs - Privilege Escalation
gvfs admin backend contains a TOCTOU race condition in gvfsd-admin daemon's chown() call on user-controlled directory pathnames, letting authenticated local attackers escalate privileges to root by modifying root-owned files.
- 7.2 /10 HighCVE-2026-88895 Auth required
CyberPanel - Authentication Bypass
CyberPanel < 3.0.5 contains a broken authentication caused by failure to enforce two-factor authentication on API endpoints, letting attackers with administrator passwords bypass TOTP and perform administrative actions without second factor.
- 7.5 /10 HighCVE-2026-88893 No auth
OpenPanel - Broken Access Control
OpenPanel contains an information disclosure caused by failure to validate access controls in share lookup procedures, letting unauthenticated attackers retrieve password hashes and report definitions via share links, exploit requires share link access.
- 8.3 /10 HighCVE-2026-88891 Auth required
OpenPanel - Broken Access Control
OpenPanel contains a broken access control caused by failure to enforce read-only project access on most mutating procedures, letting attackers with read-only access modify, delete, and publish project data, exploit requires explicit read-only access.
- 8.5 /10 HighCVE-2026-88890 Auth required
OpenPanel - SQL Injection
OpenPanel contains an SQL injection caused by improper validation of profile.* filter column identifiers in the analytics filter builder, letting authenticated attackers with project-scoped read or root export credentials bypass project isolation and access other organizations' analytics data and profile PII.
- 7.8 /10 HighCVE-2026-88889 Auth required
Renovate - Command Injection
Renovate < 44.14.7 contains a command injection caused by unescaped distributionType parameter in maven-wrapper.properties in Maven Wrapper manager, letting attackers execute arbitrary commands remotely during Maven Wrapper updates in binarySource=docker mode.
- 7.0 /10 HighCVE-2026-88888 Auth required
Renovate - Command Injection
Renovate < 44.14.7 contains a command injection caused by unescaped organization parameters in the Mix manager when processing private dependencies, letting attackers execute arbitrary commands as the Renovate user in docker mode.