High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 13 of 725
- 8.0 /10 HighCVE-2026-120205 No auth
Thelia - Stored XSS
Thelia < 3.1.0 contains a stored XSS caused by unescaped customer names in ForSomeCustomers::getSummary(), letting unauthenticated attackers inject scripts that execute when admins view coupons, exploit requires attacker registration with script payload.
- 8.8 /10 HighCVE-2026-120203 Auth required
ShowDoc - Command Injection
ShowDoc 2.8.14 before 3.9.6 contains a command injection caused by eval() execution of mockjs templates in Mock feature, letting authenticated users execute shell commands as root, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-120194
json-glib - Denial of Service
json-glib contains a denial of service caused by infinite loop in JSONPath slice evaluator with negative step, letting attackers force applications evaluating attacker-controlled JSONPath expressions to hang, exploit requires attacker-controlled JSONPath input.
- 8.2 /10 HighCVE-2026-120135 No auth
Apache Thrift - Denial of Service
Apache Thrift Java bindings < 0.24.0 contain an uncontrolled recursion vulnerability caused by improper recursion handling, letting attackers cause denial of service via resource exhaustion, exploit requires crafted input.
- 7.2 /10 HighCVE-2026-120114 No auth
Debug Log Manager WordPress Plugin - Stored XSS
Debug Log Manager WordPress plugin <= 2.5.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'message' and 'pageUrl' parameters, letting unauthenticated attackers inject scripts executing on user access, exploit requires debug logging enabled with JS error logging and attacker obtaining dlmVars.jsErrorLogging nonce.
- 7.2 /10 HighCVE-2026-120075 No auth
WP Activity Log - Stored XSS
WP Activity Log plugin for WordPress <= 5.6.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.
- 8.8 /10 HighCVE-2026-120070 Auth required
User Frontend - Privilege Escalation
User Frontend WordPress plugin <= 4.3.13 contains a privilege escalation caused by improper sanitization of post_content in submit_post(), letting authenticated subscribers inject editor role shortcode to create privileged accounts, exploit requires subscriber-level access.
- 7.5 /10 HighCVE-2026-120040 Auth required
WordPress Mail logging & Catcher - Sensitive Information Exposure & Privilege Escalation
Mail logging & Catcher plugin for WordPress <= 2.2.0 contains a sensitive information exposure caused by improper access control on the 'message' parameter, letting authenticated subscribers extract admin password-reset keys and escalate privileges, exploit requires plugin default_view_role misconfiguration.
- 8.1 /10 HighCVE-2026-119977 CISA KEVNo auth
WordPress Core - Remote Code Execution
WordPress Core 4.7 through 7.1.3 contains a remote code execution caused by predictable, web-accessible staging paths during full-package core upgrades, letting unauthenticated attackers execute code on the server during upgrade window.
- 7.5 /10 HighCVE-2026-119163 No auth
FunnelKit Automations WordPress - SQL Injection
FunnelKit Automations WordPress plugin <= 3.8.5.2 contains a time-based SQL injection caused by insufficient escaping of 'bwfan_cart_id' parameter in SQL queries, letting unauthenticated attackers extract sensitive database information, exploit requires crafted bwfan_cart_id during guest Store API checkout with WooCommerce cart nonce.
- 7.2 /10 HighCVE-2026-119162
User Submitted Posts WordPress Plugin - Stored XSS
User Submitted Posts WordPress plugin <= 20260916 contains a stored DOM-based cross-site scripting caused by insufficient sanitization and escaping of 'user-submitted-content' parameter, letting unauthenticated attackers inject scripts executed on page access, exploit requires 'publish immediately' option enabled.
- 7.2 /10 HighCVE-2026-119089 No auth
ThirstyAffiliates Affiliate Links - Stored XSS
ThirstyAffiliates Affiliate Links plugin for WordPress <= 3.12.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts on block themes, exploit requires one prior approved comment.
- 7.2 /10 HighCVE-2026-119065 No auth
Shipping Zones by Drawing for WooCommerce - Stored XSS
Shipping Zones by Drawing for WooCommerce <= 3.3.0 contains a stored cross-site scripting caused by improper sanitization and output encoding of 'szbd-picked' checkout parameter, letting unauthenticated attackers inject scripts in admin order view, exploit requires guest checkout order submission with crafted payload.
- 7.4 /10 HighCVE-2026-118147 No auth
Visual Studio - Spoofing
Visual Studio contains an improper certificate validation vulnerability caused by inadequate certificate checks, letting unauthorized attackers perform network spoofing, exploit requires network access.
- 7.2 /10 HighCVE-2026-118070 No auth
Welcart e-Commerce - Stored XSS
Welcart e-Commerce plugin for WordPress <= 2.12.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of the 'gid' parameter, letting unauthenticated attackers inject scripts executed by administrators viewing orders.