High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 15 of 725
- 7.5 /10 HighCVE-2026-109197 No auth
WP Directory Kit - SQL Injection
WP Directory Kit plugin for WordPress <= 1.6.0 contains a SQL injection caused by insufficient escaping of the 'idfield' parameter, letting unauthenticated attackers extract sensitive database information remotely.
- 7.2 /10 HighCVE-2026-107759 No auth
WPO365 MICROSOFT 365 GRAPH MAILER - Stored XSS
WPO365 MICROSOFT 365 GRAPH MAILER plugin for WordPress <= 6.2 contains a stored XSS caused by insufficient input sanitization and output escaping in the 'Subject' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires mail-sending feature with incomplete OAuth authorization.
- 7.2 /10 HighCVE-2026-107750 No auth
WooCommerce PDF Invoices & Packing Slips - Stored XSS
WooCommerce PDF Invoices & Packing Slips plugin <= 5.16.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in billing_address and customer_note parameters, letting unauthenticated attackers inject scripts executed on page access, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-107653 No auth
SureCart WordPress Plugin - Stored XSS
SureCart WordPress plugin <= 4.9.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts executed when users access affected pages, exploit requires comment approval and visibility on pages loading SureCart web-component bundle.
- 8.8 /10 HighCVE-2026-104012 No auth
Rox Appointment Booking - Privilege Escalation
Rox Appointment Booking WordPress plugin <= 1.3.1 contains a privilege escalation via mass assignment in the public REST endpoint, letting unauthenticated attackers persist arbitrary wp_user_id and email, exploit requires an administrator to open and save the poisoned customer record.
- 8.1 /10 HighCVE-2026-103898 CISA KEVNo auth
Wp Social Login and Register Social Counter - Authentication Bypass
Wp Social Login and Register Social Counter plugin for WordPress <= 3.2.2 contains an authentication bypass caused by improper verification of OAuth provider email in the social login REST callback, letting unauthenticated attackers gain authenticated sessions as any user, exploit requires attacker-controlled OAuth account with matching email.
- 8.4 /10 HighCVE-2026-102212 No auth
Opengear IM72XX, CM71XX, ACM70XX - Buffer Overflow
Opengear IM72XX, CM71XX, and ACM70XX firmware 4.8.0 through 5.5.2 contain a heap-based buffer overflow caused by an overlong Content-Disposition name field in multipart/form-data POST requests, letting unauthenticated remote attackers crash the index.cgi process.
- 7.2 /10 HighCVE-2026-97645 No auth
Gravity Forms - Stored XSS
Gravity Forms plugin for WordPress <= 3.1.2 contains a stored XSS caused by insufficient input sanitization and output escaping in List Field, letting unauthenticated attackers inject scripts executed by admins, exploit requires admin interaction.
- 7.5 /10 HighCVE-2026-97638 No auth
Forminator Forms - Broken Access Control
Forminator Forms WordPress plugin <= 1.57.3.1 contains an insecure direct object reference caused by missing validation on 'previous_draft_id' parameter, letting unauthenticated attackers delete or overwrite other users' drafts, exploit requires attacker to have victim's draft_id.
- 7.2 /10 HighCVE-2026-96894 No auth
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce - Stored XSS
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress <= 1.17.10 contains a stored XSS caused by insufficient input sanitization and output escaping in inbound email body, letting unauthenticated attackers inject scripts executed by users, exploit requires attacker to mimic CRM outbound email.
- 7.1 /10 HighCVE-2026-94175 No auth
All In One Login - Reflected XSS
All In One Login <= 2.4.1 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 8.0 /10 HighCVE-2026-91917
Dell OpenManage Enterprise - Remote Code Execution
Dell OpenManage Enterprise < 4.8.0 contains an improper input validation vulnerability, letting low privileged attackers with adjacent network access execute arbitrary code, exploit requires adjacent network access.
- 7.1 /10 HighCVE-2026-91914
Dell OpenManage Enterprise - Authentication Bypass
Dell OpenManage Enterprise < 4.8.0 contains an authentication bypass by spoofing vulnerability, letting unauthenticated adjacent network attackers steal sessions, exploit requires adjacent network access.
- 8.8 /10 HighCVE-2026-91913 Auth required
Dell OpenManage Enterprise - Command Injection
Dell OpenManage Enterprise < 4.8.0 contains an OS command injection caused by improper neutralization of special elements, letting low privileged remote attackers execute arbitrary commands, exploit requires remote access.
- 7.3 /10 HighCVE-2026-91912 Auth required
Dell OpenManage Enterprise - Hardcoded Credentials
Dell OpenManage Enterprise < 4.8.0 contains a hardcoded cryptographic key vulnerability caused by use of hard-coded keys, letting low privileged local attackers disclose sensitive information, exploit requires local access.