High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 14 of 725

  • 7.2 /10 High
    CVE-2026-118057 No auth

    Shield Security - Stored XSS

    Shield Security WordPress plugin <= 22.3.2 contains a stored XSS caused by insufficient sanitization of the 'REQUEST_URI' parameter in the hidden 'path' column of ForTraffic.php, letting unauthenticated attackers inject scripts executed on user page access, exploit requires no authentication.

  • 8.0 /10 High
    CVE-2026-117681

    Konflux-ci - Privilege Escalation

    Konflux-ci contains a privilege escalation caused by automatic disabling of TLS certificate verification in the user interface proxy for internal backend services, letting adjacent network attackers capture cluster-scoped tokens and gain full administrative control, exploit requires adjacent network access to intercept traffic.

  • 8.4 /10 High
    CVE-2026-116964 Auth required

    Konflux-ci - Command Injection

    Konflux-ci contains a command injection caused by unvalidated script output evaluation in environment export scripts, letting attackers with repository write access execute arbitrary code in CI/CD workflows.

  • 7.4 /10 High
    CVE-2026-116755 Auth required

    SoftIron HyperCloud - Command Injection

    SoftIron HyperCloud 1.0 through 2.6.17 contains a command injection caused by unquoted here-document terminator in VM template content in the Orchestrator component, letting authenticated users with management plane access execute arbitrary OS commands, exploit requires valid credentials and management plane access.

  • 7.2 /10 High
    CVE-2026-116548 No auth

    VikRentCar Car Rental Management System - Stored XSS

    VikRentCar Car Rental Management System WordPress plugin <= 1.4.10 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'optionals' parameter, letting unauthenticated attackers inject scripts executed on user page access.

  • 7.2 /10 High
    CVE-2026-116522 No auth

    Relevanssi – A Better Search WordPress plugin - Stored XSS

    Relevanssi – A Better Search WordPress plugin <= 4.28.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts executed when users access injected pages, exploit requires comment indexing and highlighting enabled with specific search-result permalink.

  • 7.2 /10 High
    CVE-2026-116520 No auth

    PPWP Password Protect Pages - Stored XSS

    PPWP – Password Protect Pages WordPress plugin <= 1.9.26 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'desc_below_form' shortcode attribute, letting unauthenticated attackers inject scripts executed by users accessing the page.

  • 8.8 /10 High
    CVE-2026-116086 Auth required

    Konflux-ci - Information Disclosure

    Konflux-ci contains an information disclosure caused by unsanitized user input in workflow scripts, letting attackers with permission to trigger workflows inject malicious filters and expose sensitive data in logs.

  • 7.2 /10 High
    CVE-2026-115840 No auth

    VikRentCar Car Rental Management System - Stored XSS

    VikRentCar Car Rental Management System WordPress plugin <= 1.4.9 contains a stored XSS caused by insufficient sanitization of 'poplink' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires WordPress nonce accessible publicly.

  • 8.6 /10 High
    CVE-2026-114217 No auth

    Konflux-ci - Broken Access Control

    Konflux-ci contains a sensitive data exposure caused by storing GitHub access tokens in plaintext on the runner without cleanup, letting local attackers access credentials and modify repositories, exploit requires local access to CI environment.

  • 7.2 /10 High
    CVE-2026-111254 No auth

    W3 Total Cache WordPress Plugin - Stored XSS

    W3 Total Cache WordPress plugin <= 2.10.7 contains a stored XSS caused by insufficient sanitization and escaping of the 'comment' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires prior Pro license with REST caching enabled and attacker having approved commenter identity.

  • 7.2 /10 High
    CVE-2026-110530 No auth

    WordPress FeedWordPress - Stored XSS

    FeedWordPress plugin for WordPress <= 2026.0517 contains a stored XSS caused by insufficient sanitization of syndicated RSS/Atom feed content in SyndicatedPost functions, letting unauthenticated attackers inject scripts executed by users visiting injected pages.

  • 8.7 /10 High
    CVE-2026-110176 No auth

    Drupal File Force Download - Broken Access Control

    Drupal File Force Download module 7.1.0 through 7.1.2 contains an access control bypass caused by improper header handling in hook_file_download(), letting unauthenticated attackers download files in temporary:// or other non-private schemes, exploit requires crafted URL with download=1 parameter.

  • 7.2 /10 High
    CVE-2026-109997 No auth

    Ninja Forms - Stored XSS

    Ninja Forms WordPress plugin <= 3.15.5 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'formData.extra' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-109234

    Meow Lightbox WordPress Plugin - Stored XSS

    Meow Lightbox WordPress plugin <= 5.6.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'post_content' parameter, letting unauthenticated attackers execute arbitrary JavaScript, exploit requires specific plugin settings and stored HTML submission surface.