High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 9 of 725
- 7.2 /10 HighCVE-2026-120318 Auth required
Product Gallery Slider & Additional Variation Images for WooCommerce - Broken Access Control
Product Gallery Slider & Additional Variation Images for WooCommerce < 2.3.26 contains a broken access control caused by missing authorization in Codestar backup AJAX actions, letting shop managers read, overwrite, or delete WordPress options including wp_user_roles to escalate privileges, exploit requires shop manager privileges.
- 8.8 /10 HighCVE-2026-120315 Auth required
LobeHub Chat - Path Traversal
LobeHub Chat 1.84.26 < 2.1.49 contains a path traversal caused by unsanitized file names in writeTempFile(), letting authenticated users write arbitrary files and execute code or cause denial of service.
- 7.3 /10 HighCVE-2026-120314 No auth
Network-AI - Authentication Bypass
Network-AI 5.14.0 < 5.15.5 contains a broken authentication caused by missing secret configuration in A2AServer class, letting unauthenticated attackers execute, read, and cancel tasks via JSON-RPC requests without Bearer token.
- 7.5 /10 HighCVE-2026-120313 No auth
Network-AI - Path Traversal
Network-AI < 5.15.5 contains a path traversal vulnerability caused by improper path sanitization in InputSanitizer.sanitizePath(), letting attackers read, list, or write files outside the sandbox, exploit requires crafted path input.
- 8.8 /10 HighCVE-2026-120312 Auth required
Network-AI - Path Traversal
Network-AI 5.13.4 < 5.15.5 contains a path traversal caused by improper validation of cassette name in AgentVCR, letting attackers read or write arbitrary JSON files, exploit requires attacker control of cassette name.
- 8.8 /10 HighCVE-2026-120311 Auth required
Network-AI - Path Traversal
Network-AI 5.13.4 < 5.15.5 contains a path traversal caused by traversal sequences in job id in FileJobStore, letting attackers read or delete arbitrary .json files, exploit requires attacker control of job id.
- 8.7 /10 HighCVE-2026-120091 Auth required
Temporal Server - Command Injection
Temporal Server 1.31.0 through 1.31.2 contains a command injection caused by building a Kubernetes client from caller-supplied configuration in the k8s compute provider module, letting authenticated namespace users execute commands on the Worker Service host, exploit requires authorization with access to ValidateWorkerDeploymentVersionComputeConfig operation.
- 7.1 /10 HighCVE-2026-120065 Auth required
psqlODBC - Broken Access Control
psqlODBC before 18.00.0006 contains a broken access control vulnerability caused by improper handling of column names with double quotes in updatable cursor queries, letting database users manipulate SQL statements to affect row updates or deletes, exploit requires ability to create tables read by the application.
- 7.5 /10 HighCVE-2026-120064 Auth required
psqlODBC - Out of Bounds Read/Write
psqlODBC < 18.00.0006 contains an out-of-bounds read/write caused by lack of validation on application-supplied column and row indexes, letting attackers cause memory corruption, exploit requires forwarding untrusted indexes.
- 7.5 /10 HighCVE-2026-120062 Auth required
psqlODBC - SQL Injection
psqlODBC < 18.00.0006 contains a SQL injection caused by unescaped table and schema names in SQLSpecialColumns catalog query, letting attackers execute arbitrary SQL with connection privileges, exploit requires passing untrusted input.
- 7.5 /10 HighCVE-2026-120061 Auth required
psqlODBC - Buffer Overflow
psqlODBC before 18.00.0006 contains a buffer overflow caused by improper handling of ODBC escape sequences in SQL text, letting attackers cause memory corruption via crafted SQL queries, exploit requires untrusted SQL input.
- 7.5 /10 HighCVE-2026-120058 No auth
psqlODBC - Out of Bounds Read/Write
psqlODBC before 18.00.0006 contains a buffer overflow caused by inconsistent column count handling in FETCH replies with UseDeclareFetch enabled, letting untrusted servers write past allocated heap memory.
- 7.5 /10 HighCVE-2026-120057
psqlODBC - Buffer Overflow
psqlODBC < 18.00.0006 contains a buffer overflow caused by copying large-object read replies without buffer size validation, letting man-in-the-middle or untrusted servers overwrite adjacent memory, exploit requires fetching any large-object column.
- 7.8 /10 HighCVE-2026-119737 Auth required
Amlogic Android SDK pppoe_wrapper - Command Injection
Amlogic Android SDK pppoe_wrapper vendor daemon contains a command injection caused by unfiltered messages to a world-writable AF_UNIX socket, letting local attackers execute arbitrary commands as root, exploit requires local access.
- 8.2 /10 HighCVE-2026-119736 No auth
Attendo Admin Android - Hardcoded Credentials
Attendo Admin Android application <= 3.0.13 contains a hardcoded credentials vulnerability caused by embedded MQTT broker credentials in Flutter configuration files, letting attackers extract credentials and access sensitive messaging topics, exploit requires APK decompilation.