High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 15 of 552
- 7.2 /10 HighCVE-2026-97398 No auth
FV Flowplayer Video Player - Stored XSS
FV Flowplayer Video Player plugin for WordPress <= 7.5.54.7212 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'synopsis' shortcode attribute, letting unauthenticated attackers inject scripts, exploit requires 'Parse Vimeo and YouTube links' option enabled and liststyle attribute set to 'season'.
- 7.2 /10 HighCVE-2026-97278 Auth required
WP SYNTEX Polylang - Insecure Deserialization
WP SYNTEX Polylang <= 3.8.9 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires no special privileges.
- 8.1 /10 HighCVE-2026-97205 PoC publicNo auth
NGINX Plus & Open Source - Use After Free
NGINX Plus and NGINX Open Source contain a use-after-free vulnerability in ngx_http_core_module when asynchronous file I/O is enabled and processing SSI pages with "include virtual" commands, letting remote attackers cause denial-of-service, memory corruption, or code execution, exploit requires ASLR disabled or bypass.
- 7.5 /10 HighCVE-2026-96661 No auth
Gmedia Photo Gallery - SQL Injection
Gmedia Photo Gallery WordPress plugin <= 1.25.1 contains a time-based SQL injection caused by insufficient escaping of the 'gmedia__in' parameter in the mobile app endpoint, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication or session.
- 7.2 /10 HighCVE-2026-95816 No auth
Smart Forms - Stored XSS
Smart Forms WordPress plugin <= 2.6.104 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'formString' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires no authentication by default.
- 7.5 /10 HighCVE-2026-95808 No auth
10Web Form Maker - SQL Injection
Form Maker by 10Web WordPress plugin <= 1.15.48 contains a blind SQL injection caused by insufficient escaping of the 'inputs' parameter, letting unauthenticated attackers extract sensitive database information, exploit requires nonce from public pages.
- 7.2 /10 HighCVE-2026-94377 No auth
Verified Reviews WordPress Plugin - Stored XSS & Authentication Bypass
Verified Reviews WordPress plugin <= 2.4.6 contains a stored cross-site scripting caused by insufficient sanitization and output escaping of the 'moderation' parameter, letting unauthenticated attackers inject scripts executed on page access, exploit requires crafted JSON with boolean true values for idWebsite and sign.
- 8.2 /10 HighCVE-2026-94200 No auth
Erlang OTP ssl - Denial of Service
Erlang OTP ssl (tls_handshake_1_3, ssl_handshake, tls_client_ticket_store) < 11.2.12.14, 11.6.0.7, 11.7.8 contains a denial of service caused by improper validation of NewSessionTicket extensions, letting malicious TLS 1.3 servers crash ssl application on client nodes, exploit requires malicious TLS 1.3 server.
- 7.5 /10 HighCVE-2026-94197 No auth
F5 NGINX Kubernetes Ingress Controller - Authentication Bypass
F5 NGINX Kubernetes Ingress Controller contains an authentication and authorization bypass caused by unsanitized forwarding of client-supplied routing and method headers in the internal authentication subrequest, letting unauthenticated remote attackers access protected paths, exploit requires ExternalAuth policy or Ingress external authentication configuration.
- 7.2 /10 HighCVE-2026-93885 No auth
Cryptocurrency Donation Box – Bitcoin & Crypto Donations - Stored XSS
Cryptocurrency Donation Box – Bitcoin & Crypto Donations WordPress plugin <= 2.2.13 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in data_object parameter, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires nonce bypass via publicly exposed nonce.
- 8.1 /10 HighCVE-2026-93479 No auth
NGINX - Buffer Overflow
NGINX Plus and NGINX Open Source contain a heap buffer overflow caused by improper handling of regex capture variables in map directives with root or access log format referencing, letting unauthenticated attackers cause denial of service or code execution, exploit requires crafted HTTP requests under specific conditions.
- 8.8 /10 HighCVE-2026-92817 Auth required
Ignition Perspective - Broken Access Control
Ignition Perspective module contains a broken access control vulnerability caused by improper validation of session privileges, letting authenticated users with Vision project access escalate to Designer-level privileges and execute arbitrary code, exploit requires valid Vision session identifier.
- 8.1 /10 HighCVE-2026-92392 PoC publicNo auth
curl - Use After Free
curl contains a use after free vulnerability caused by mishandling HTTP/2 RST_STREAM frames with reason HTTP_1_1_REQUIRED or REFUSED_STREAM during upload, letting remote attackers cause memory corruption, exploit requires crafted server response.
- 7.2 /10 HighCVE-2026-92158 Auth required
F´ (F Prime) - Buffer Overflow
F´ (F Prime) < 4.2.0 contains a buffer overflow caused by integer wraparound in Svc::FpySequencer STORE directive stack write validation, letting attackers cause memory corruption, denial of service, or code execution, exploit requires crafted STORE directive with wrapped offset and size.
- 7.5 /10 HighCVE-2026-92155 No auth
F´ (F Prime) - Denial of Service
F´ (F Prime) < 4.2.0 contains a denial of service caused by invalid Type enum casting in Fw::FilePacket deserialization used by Svc::FileUplink, letting attackers crash or reset the application process, exploit requires crafted network file packet.