High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 12 of 552
- 7.5 /10 HighCVE-2026-15090 No auth
Link Library WordPress plugin - SQL Injection
Link Library WordPress plugin <= 7.9.2 contains a time-based SQL injection caused by insufficient escaping of the 'link_url' parameter, letting unauthenticated attackers extract sensitive database information remotely, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-110912 PoC publicNo auth
DragonFly BSD - Information Disclosure
DragonFly BSD <= 6.4.2 before 4bb22ff contains an out-of-bounds read caused by improper validation of hardware and protocol address lengths in ARP input handlers, letting unauthenticated adjacent network attackers disclose kernel memory via crafted ARP requests.
- 8.8 /10 HighCVE-2026-110908 Auth required
Netgate pfSense FRR - Command Injection
Netgate pfSense FRR package 2.0.2_1 and source revision 2.1.2_1 contain a command injection caused by improper sanitization of filter input in the FRR status filter, letting authenticated WebGUI users with page-status-frr privilege execute commands as root, exploit requires authenticated user with specific privilege.
- 7.5 /10 HighCVE-2026-110907 No auth
Backdrop CMS Core - Broken Access Control
Backdrop CMS Core 1.35.x < 1.35.2 and 1.34.x < 1.34.6 contain an information disclosure vulnerability caused by insufficient access control on token types in the token browser, letting attackers access restricted token types, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-110723 No auth
api-gateway - Broken Access Control
api-gateway <= 1.7.3 contains a broken access control caused by unvalidated use of the leftmost element of X-Forwarded-For header in ClientIpKeyResolver, letting attackers bypass request-rate limiting, exploit requires attacker to control X-Forwarded-For header.
- 7.5 /10 HighCVE-2026-109855 No auth
undici - Denial of Service
undici 8.11.0 and 8.11.1 contain a denial of service caused by mishandling failed WebSocket handshake over HTTP/2 in the experimental WebSocket client, letting remote unauthenticated servers crash clients, exploit requires opening WebSocket over HTTP/2.
- 7.1 /10 HighCVE-2026-109702 No auth
maxfoundry Social Share Buttons - Stored XSS
maxfoundry Social Share Buttons <= 1.31 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-109695 No auth
WPManageNinja FluentCart - Information Disclosure
WPManageNinja FluentCart <= 1.7.1 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-109693 Auth required
WP ManageNinja LLC Fluent CRM - Broken Access Control
WP ManageNinja LLC Fluent CRM <= 3.2.5 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires attacker to have initial access.
- 7.1 /10 HighCVE-2026-109692 Auth required
ThemeGrill User Registration - Broken Access Control
ThemeGrill User Registration <= 5.2.8 contains an incorrect access control vulnerability caused by missing authorization checks, letting attackers exploit access control weaknesses, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-109685 No auth
Link Whisper INC Link Whisper Free - Reflected XSS
Link Whisper INC Link Whisper Free <= 0.9.7 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-109430 No auth
Ellucian WebAdvisor - XML External Entity Injection
Ellucian WebAdvisor 3.2 contains an XML External Entity (XXE) injection caused by enabled external entity and DTD resolution in /WebAdvisor/WebAdvisor endpoint, letting remote attackers perform SSRF, disclose NTLMv2 hashes, and read arbitrary files, exploit requires crafted XML POST requests.
- 8.7 /10 HighCVE-2026-109413 No auth
Symfony YAML - Denial of Service
Symfony YAML < 5.4.54, 6.4.45, 7.4.18, and 8.1.6 contains a denial of service caused by unbounded recursion in lexInlineStructure() when parsing deeply nested inline collections, letting unauthenticated attackers crash the process via crafted YAML payloads, exploit requires sending a YAML content type request.
- 7.1 /10 HighCVE-2026-108498 No auth
bannersky BSK PDF Manager - Stored XSS
bannersky BSK PDF Manager <= 3.8.1 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on other users, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-108491 No auth
Everest Forms Everest Forms - Stored XSS
Everest Forms Everest Forms <= 3.6.1 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires no special privileges.