High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 11 of 552
- 7.3 /10 HighCVE-2026-3712 No auth
PhastPress WordPress Plugin - Server-Side Request Forgery
PhastPress WordPress plugin <= 3.10 contains a server-side request forgery caused by dynamic URL whitelist construction from attacker-controlled HTTP 'Host' header, letting unauthenticated attackers make arbitrary HTTP requests.
- 8.2 /10 HighCVE-2026-35088 No auth
Slican Telephone Exchanges - Information Disclosure
Slican telephone exchanges use symmetric encryption with hardcoded secret keys in multiple binaries, letting attackers with file access decrypt communication, exploit requires access to binary files.
- 8.7 /10 HighCVE-2026-34015 Auth required
Video Station - Path Traversal
Video Station < 5.8.8 contains a path traversal caused by improper input validation, letting remote attackers with user accounts read arbitrary files, exploit requires user authentication.
- 8.4 /10 HighCVE-2026-34014 Auth required
Download Station - Broken Access Control
Download Station contains an incorrect permission assignment vulnerability affecting critical resources, letting local attackers with administrator accounts compromise system security, exploit requires administrator privileges.
- 8.4 /10 HighCVE-2026-34009 Auth required
Notes Station 3 - Broken Access Control
Notes Station 3 contains a broken access control vulnerability caused by improper isolation or compartmentalization, letting local attackers with administrator privileges compromise system security, exploit requires administrator access.
- 8.5 /10 HighCVE-2026-34008 Auth required
Notes Station 3 - Broken Access Control
Notes Station 3 contains a broken access control vulnerability caused by incorrect permission assignment for critical resources, letting local attackers with user accounts compromise system security, exploit requires local user account.
- 7.1 /10 HighCVE-2026-26245 Auth required
Video Station - SQL Injection
Video Station < 5.8.8 contains a SQL injection caused by improper sanitization of user input, letting remote attackers with user accounts execute unauthorized commands, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-26244 Auth required
Video Station - SQL Injection
Video Station < 5.8.8 contains a SQL injection caused by improper sanitization of user input, letting remote attackers with user accounts execute unauthorized commands, exploit requires user authentication.
- 7.2 /10 HighCVE-2026-26243 Auth required
Qsync Central - Path Traversal
Qsync Central < 5.0.0.6, < 5.1.0.2, < 5.2.0.4 contains a path traversal caused by insufficient input validation, letting remote attackers with user accounts read arbitrary files.
- 8.8 /10 HighCVE-2026-18661 No auth
Eclipse Jetty - Broken Access Control
Eclipse Jetty jetty-annotations and jetty-eeN-annotations contain a broken access control caused by incorrect application of Jakarta Spec url-pattern rules when mixed @ServletSecurity and web.xml security-constraints exist, letting attackers bypass security constraints on some url-patterns, exploit requires specific web.xml configuration with multiple url-patterns.
- 8.8 /10 HighCVE-2026-18660 No auth
Eclipse Jetty - Broken Access Control
Eclipse Jetty jetty-server and jetty-proxy contain a broken access control caused by case-sensitive host whitelist/blacklist, letting attackers bypass host restrictions by using case variations, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-18586 No auth
Premium Packages – Sell Digital Products Securely - Stored XSS
Premium Packages – Sell Digital Products Securely WordPress plugin <= 7.0.5 contains a stored XSS caused by insufficient sanitization and escaping of 'order_email', letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-18548 No auth
Groundhogg CRM, Newsletters, and Marketing Automation - Stored XSS
Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress <= 4.5.14 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'ref' parameter, letting unauthenticated attackers execute arbitrary scripts when users access injected pages.
- 8.1 /10 HighCVE-2026-17031 Auth required
Checkout Field Manager for WooCommerce - Authorization Bypass
Checkout Field Manager for WooCommerce plugin for WordPress <= 7.9.6 contains an authorization bypass caused by improper user authorization verification, letting authenticated attackers with subscriber-level access delete arbitrary Media Library attachments.
- 7.1 /10 HighCVE-2026-16437 Auth required
Mitsubishi Electric GENESIS - Broken Authentication
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz (various versions) contain a weak password recovery mechanism caused by tampering with the management file storing the challenge response, letting authenticated local administrators disclose, tamper, or cause denial of service, exploit requires administrative privileges.