High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 12 of 725
- 7.4 /10 HighCVE-2026-84231 No auth
Apache Wicket - Stored XSS
Apache Wicket 8.0.0 through 8.19.0 contains a stored XSS caused by improper escaping of URLs in ExternalLink component's JavaScript click handler, letting attackers execute script when users activate the element.
- 8.3 /10 HighCVE-2026-84170 No auth
Apache Wicket - Denial of Service
Apache Wicket 9.14.0 to 9.24.0 and 10.0.0 to 10.9.1 contain an unrestricted resource allocation vulnerability caused by unbounded upload size parameters in AbstractFileUploadResource, letting unauthenticated attackers exhaust server disk or memory, exploit requires deliberate mounting of the vulnerable upload resource.
- 8.3 /10 HighCVE-2026-83594 No auth
Apache Wicket - Denial of Service
Apache Wicket 9.14.0 to 9.24.0 and 10.0.0 to 10.11.0 contain a denial of service caused by excessive memory allocation from unvalidated file size in FileUploadToResourceField callback, letting attackers exhaust server heap remotely without authentication, exploit requires calling UploadInfo#get().
- 7.4 /10 HighCVE-2026-83559 No auth
Apache Wicket - Stored XSS
Apache Wicket 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 contain a stored XSS caused by improper escaping of backslashes in JavaScript string literals in JavaScriptUtils#escapeQuotes(), letting attackers execute arbitrary JavaScript in user sessions, exploit requires attacker-controlled input in validation messages or similar.
- 7.4 /10 HighCVE-2026-83539 No auth
Apache Wicket - Stored XSS
Apache Wicket 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 contain a stored XSS caused by improper neutralization of input in SmartLinkLabel and SmartLinkMultiLineLabel components, letting attackers execute script via crafted URLs, exploit requires user to activate the malicious link.
- 7.6 /10 HighCVE-2026-82956 No auth
Apache Wicket - Stored XSS
Apache Wicket 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 contain a stored XSS caused by improper neutralization of client-supplied windowName parameter in AjaxNewWindowNotifyingBehavior, letting attackers execute script in the application's origin, exploit requires explicit use of AjaxNewWindowNotifyingBehavior.
- 7.2 /10 HighCVE-2026-82840
Apache Wicket - Authentication Bypass
Apache Wicket 8.18.0-8.19.0, 9.23.0-9.24.0, and 10.9.0-10.11.0 contain a session fixation vulnerability caused by failure to renew session ID on re-authentication in AuthenticatedWebSession, letting attackers fixate sessions, exploit requires attacker to plant a session ID in victim's browser.
- 7.1 /10 HighCVE-2026-66570 No auth
Nickboss WordPress File Upload - Stored XSS
Nickboss WordPress File Upload <= 5.2.1 contains a stored XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted input upload.
- 7.5 /10 HighCVE-2026-120241 No auth
Ruijie RG-ES Series - Buffer Overflow
Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P ESW_1.0(1)B1P48 contain a buffer overflow caused by manipulation of an unknown function in httpupg.cgi Local Firmware Upgrade Interface, letting remote attackers execute arbitrary code, exploit requires remote access.
- 8.8 /10 HighCVE-2026-120232 PoC publicAuth required
Horizon DataSys Reboot Restore Standard - Memory Corruption
Horizon DataSys Reboot Restore Standard <= 13.2 contains a memory corruption vulnerability caused by manipulation in sub_23908 function of shield.sys kernel driver, letting local attackers corrupt memory, exploit requires local access.
- 7.3 /10 HighCVE-2026-120191 No auth
Presenton - Authentication Bypass
Presenton <= 0.9.11-beta contains a broken authentication caused by missing authentication in API component, letting remote attackers bypass authentication, exploit requires no special conditions.
- 7.6 /10 HighCVE-2026-111089
Apache Wicket - Stored XSS
Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 contain a stored XSS caused by unescaped texts in JavaScript string literals and attribute values in resource bundles, letting attackers inject script in the application's origin, exploit requires attacker-controlled resource bundle entries.
- 8.8 /10 HighCVE-2026-76010 Auth required
NextGEN Gallery - Remote Code Execution
NextGEN Gallery WordPress plugin <= 4.4.1 contains a remote code execution caused by unrestricted mass assignment and missing realpath containment in render_image, letting authenticated attackers with custom-level access execute code on the server, exploit requires attacker to own at least one NextGEN gallery.
- 7.5 /10 HighCVE-2026-120208 No auth
libheif - Buffer Overflow
libheif < 1.23.3 contains a heap-based buffer overflow caused by unequal bit depths in chroma components in unc_decoder_mixed_interleave::processTile(), letting attackers execute code via crafted HEIF files, exploit requires crafted file input.
- 7.1 /10 HighCVE-2026-120207 No auth
Thelia Page Module - Cross-Site Request Forgery
Thelia Page Module < 2.0.4 contains a cross-site request forgery caused by missing CSRF tokens and permission checks in back-office delete routes, letting remote attackers delete page tags, documents, and images by tricking logged-in administrators.