High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 142 of 556

  • 7.5 /10 High
    CVE-2020-37280 No auth

    cbor-sync - Denial of Service

    cbor-sync <= 1.0.4 contains a denial of service caused by trusting declared array and map lengths without validating remaining input in CBOR.decode, letting remote attackers exhaust CPU and memory by crafted payloads.

  • 8.1 /10 High
    CVE-2020-37279 No auth

    easy-pdf-merge - Command Injection

    easy-pdf-merge 0.1.0 through 0.2.6 contains a command injection caused by injection of shell metacharacters into source paths, destination path, or maxHeap option, letting attackers execute OS commands with Node.js process privileges, exploit requires crafted input with shell metacharacters.

  • 8.8 /10 High
    CVE-2026-96227 No auth

    Piotnet Forms - Stored XSS

    Piotnet Forms WordPress plugin through 1.0.30 contains a stored XSS caused by lack of authentication and validation in form-submission file-upload, letting unauthenticated attackers execute arbitrary JavaScript in site's origin, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-91829 No auth

    Subscribe to Comments WordPress plugin - Reflected XSS

    Subscribe to Comments WordPress plugin < 2.3.3 contains a reflected XSS caused by improper validation of a parameter reflected into a link target, letting unauthenticated attackers execute scripts via crafted URLs, exploit requires victim to click the crafted URL.

  • 8.6 /10 High
    CVE-2026-89302 No auth

    Post Voting System WordPress - SQL Injection

    Post Voting System WordPress plugin <= 1.0 contains a SQL injection caused by improper sanitization and escaping of a parameter in SQL queries, letting unauthenticated attackers execute arbitrary SQL commands.

  • 8.6 /10 High
    CVE-2026-89299 No auth

    WP Verify API WordPress plugin - SQL Injection

    WP Verify API WordPress plugin through 1.0.0 contains a sql injection caused by improper sanitization and escaping of a parameter in a SQL query, letting unauthenticated attackers execute arbitrary SQL commands.

  • 8.6 /10 High
    CVE-2026-89297 No auth

    Loja Automática WordPress - SQL Injection

    Loja Automática WordPress plugin through 1.0.0 contains a sql injection caused by improper sanitization and escaping of a parameter in SQL queries, letting unauthenticated attackers execute arbitrary SQL commands.

  • 8.6 /10 High
    CVE-2026-89287 No auth

    ASPL Product Quotation WordPress plugin - SQL Injection

    ASPL Product Quotation WordPress plugin through 1.1.0 contains a SQL injection caused by unsanitized and unescaped parameters in SQL statements, letting unauthenticated attackers read arbitrary database data, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-89285 No auth

    WordPress Datalist - SQL Injection

    WordPress Datalist plugin <= 0.0.3 contains a SQL injection caused by unsanitized and unescaped request parameters used in SQL queries, letting unauthenticated attackers read arbitrary database data.

  • 8.6 /10 High
    CVE-2026-89283 No auth

    WP Posts Password Batch Manager - Broken Access Control

    WP Posts Password Batch Manager WordPress plugin through 1.1 contains a broken access control caused by lack of capability and nonce checks on bulk post-password actions, letting unauthenticated attackers reset or overwrite passwords of all published posts, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-89234 No auth

    WP-Partner WordPress plugin - SQL Injection

    WP-Partner WordPress plugin through 1.2.1 contains a SQL injection caused by unsanitized and unescaped parameter usage in SQL queries, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-89232 No auth

    Recordbrowser WordPress plugin - SQL Injection

    Recordbrowser WordPress plugin through 1.1.7 contains a SQL injection caused by unsanitized and unescaped parameter usage in SQL queries, letting unauthenticated attackers extract sensitive database information.

  • 8.6 /10 High
    CVE-2026-89214 No auth

    WpCues Basic Quiz WordPress plugin - SQL Injection

    WpCues Basic Quiz WordPress plugin <= 1.6.5 contains a SQL injection caused by improper sanitization and escaping of values in SQL statements, letting unauthenticated attackers read database data, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-89213 No auth

    Llavero.io WordPress - SQL Injection

    Llavero.io WordPress plugin <= 0.1.4 contains a SQL injection caused by improper sanitization and escaping of a parameter in SQL statements, letting unauthenticated attackers read database data remotely, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-89195 No auth

    Site Setup Wizard WordPress - SQL Injection

    Site Setup Wizard WordPress plugin <= 1.5.8 contains a SQL injection caused by improper sanitization and escaping of a parameter in SQL statements, letting unauthenticated attackers read database data.