High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 681 of 725
- 7.6 /10 HighCVE-2026-86771 PoC publicAuth required
Snipe-IT - Server Side Request Forgery
Snipe-IT < 8.7.0 contains a server-side request forgery caused by unescaped employee_num field in the acceptance PDF generator, letting attackers with users.edit permission trigger server-side HTTP requests, exploit requires users.edit permission.
- 8.1 /10 HighCVE-2026-86770 PoC publicAuth required
Snipe-IT - Authentication Bypass
Snipe-IT < 8.7.0 contains a broken authentication caused by failure to validate username case sensitivity during SAML authentication, letting attackers bypass username matching and achieve account takeover via federated login paths, exploit requires attacker to register IdP accounts with accent or case variants of victim usernames.
- 8.1 /10 HighCVE-2026-86762 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT < 8.7.0 contains a broken access control caused by missing CheckUserIsActivated middleware in the API group and non-revocation of personal access tokens, letting attackers with deactivated accounts maintain API access and re-activate themselves.
- 7.1 /10 HighCVE-2026-86759 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT < 8.7.0 contains a broken access control caused by failure to authorize POST /hardware/history endpoint, letting authenticated users reassign assets and modify audit logs, exploit requires user authentication.
- 7.3 /10 HighCVE-2026-86754 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT < 8.7.0 contains a broken access control vulnerability caused by improper gating of Laravel Passport OAuth client management routes, letting authenticated users register OAuth clients with attacker-controlled redirect URIs, exploit requires user authentication.
- 8.5 /10 HighCVE-2026-86751 PoC publicAuth required
Snipe-IT - Server-Side Request Forgery & Information Disclosure
Snipe-IT < 8.7.0 contains a server-side request forgery and file read vulnerability caused by improper sanitization of markdown image syntax in note fields, letting authenticated users read arbitrary server files and issue HTTP requests.
- 7.7 /10 HighCVE-2026-86750 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT <= 8.6.3 contains a broken access control caused by improper validation of company assignment authorization in user record persistence via REST API, letting non-superuser attackers create or relocate user accounts across tenant boundaries, exploit requires Full Multiple Companies Support enabled and specific permissions.
- 8.5 /10 HighCVE-2026-86741 PoC publicAuth required
Snipe-IT - Server Side Request Forgery
Snipe-IT < 8.7.0 contains a server-side request forgery caused by unsanitized category EULA text field rendering in checkout confirmation emails, letting low-privilege attackers exfiltrate sensitive files and perform SSRF.
- 7.5 /10 HighCVE-2026-86201 No auth
PocketMine-MP - Denial of Service
PocketMine-MP < 5.41.1 contains a denial of service caused by unsanitized large or complex structures in unknown clientData JWT properties during LoginPacket processing, letting attackers crash the server by triggering out-of-memory conditions, exploit requires sending crafted LoginPackets.
- 7.5 /10 HighCVE-2026-86199 No auth
PocketMine-MP - Denial of Service
PocketMine-MP < 5.43.1 contains a denial of service caused by improper validation of the Certificate field during offline login authentication, letting unauthenticated players crash the server by triggering an uninitialized property access error.
- 8.2 /10 HighCVE-2026-86099 No auth
Chainlit - Path Traversal
Chainlit through 2.12.0 contains a path traversal caused by improper validation of client-supplied socket.io sessionId parameter, letting unauthenticated attackers delete arbitrary directories, exploit requires crafted sessionId values.
- 7.2 /10 HighCVE-2026-84293 No auth
Gravity Forms Repeater Fields - Stored XSS
Gravity Forms Repeater Fields plugin for WordPress <= 3.0.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in repeated multi-input sub-field values, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires multi-input sub-field usage.
- 8.6 /10 HighCVE-2026-84068 No auth
Quentn WP WordPress plugin - SQL Injection
Quentn WP WordPress plugin < 1.2.15 contains a SQL injection caused by unescaped request parameter in an unprepared SQL query, letting unauthenticated attackers extract arbitrary data from the database.
- 7.2 /10 HighCVE-2026-83593 No auth
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services - Stored XSS
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services WordPress plugin <= 8.7.3 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'conversation' parameter, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires bypassing ineffective nonce check.
- 7.6 /10 HighCVE-2026-82563
Camera Device - Man-in-the-Middle
A camera device contains a man-in-the-middle vulnerability caused by lack of proper authentication, letting attackers impersonate the device to manipulate status responses and observe application requests, exploit requires attacker to impersonate the camera.