High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 153 of 556
- 8.1 /10 HighCVE-2026-108657 Auth required
JeecgBoot - Broken Access Control
JeecgBoot <= 3.9.5 contains a broken access control vulnerability in SysTenantController passApply handler, letting authenticated users approve tenant admin applications, exploit requires user authentication.
- 8.1 /10 HighCVE-2026-108628 Auth required
JeecgBoot - Broken Access Control
JeecgBoot through 3.9.5 contains a broken access control vulnerability caused by missing authorization in the saveDeptRolePermission endpoint of SysDepartPermissionController, letting authenticated low-privileged users modify department role permissions, exploit requires authentication.
- 7.1 /10 HighCVE-2026-108623 Auth required
JeecgBoot - Broken Access Control
JeecgBoot <= 3.9.5 contains a broken access control vulnerability in SysLogController deleteBatch handler, letting authenticated low-privileged users delete system audit log entries, exploit requires authentication.
- 7.5 /10 HighCVE-2026-108553 No auth
OpenRefine - Cross-Site Request Forgery
OpenRefine <= 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command, letting remote attackers execute Jython facet expressions and OS commands via crafted engine parameter, exploit requires user interaction.
- 8.8 /10 HighCVE-2026-108550 Auth required
SkillHub - Broken Access Control
SkillHub < 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController, letting authenticated attackers take over other accounts by abusing the merge flow, exploit requires attacker to be authenticated.
- 8.1 /10 HighCVE-2026-108549 No auth
cc-connect - Authentication Bypass
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go, letting remote attackers forge privileged updates and execute commands, exploit requires no webhook_secret configured.
- 7.3 /10 HighCVE-2026-108548 No auth
AstronRPA - Authentication Bypass
AstronRPA <= 1.1.6 contains an authentication bypass caused by OpenResty gateway's auth_handler.lua accepting any Bearer token without validation, letting unauthenticated attackers act as any user by spoofing headers.
- 7.5 /10 HighCVE-2026-108546 No auth
Spotweb - Command Injection
Spotweb <= 1.5.8 contains a command injection caused by unescaped shell metacharacters in spot titles in the runcommand NZB handler, letting remote attackers execute OS commands as the Spotweb PHP process, exploit requires user to download malicious spots.
- 7.5 /10 HighCVE-2026-108161 No auth
FusionPBX - Command Injection
FusionPBX through 5.6.5 contains a command injection vulnerability caused by improper sanitization of caller ID values in call_recordings::download(), letting unauthenticated attackers execute OS commands as the web server user when privileged users download multiple recordings as a ZIP, exploit requires record_name filename template enabled.
- 7.2 /10 HighCVE-2026-107742 No auth
10Web Booster - Stored XSS
10Web Booster WordPress plugin <= 2.34.8 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of the 'author' parameter, letting unauthenticated attackers inject scripts executed when users access the injected page.
- 7.2 /10 HighCVE-2026-107657 No auth
HivePress Business Directory, Listings & Classified Ads Plugin - Stored XSS
HivePress Business Directory, Listings & Classified Ads Plugin for WordPress <= 1.7.31 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in custom user attribute fields, letting unauthenticated attackers inject scripts executed on user page access, exploit requires admin configuration of text-type custom user attribute with HTML attribute context and enabled front-end user profiles.
- 7.5 /10 HighCVE-2026-106609 No auth
Bayarcash WooCommerce - Broken Access Control
Bayarcash WooCommerce <= 4.4.2 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-106608 Auth required
Automattic WooCommerce - Privilege Escalation
Automattic WooCommerce 9.8.0 through 11.1.2 contains a privilege escalation caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.
- 7.2 /10 HighCVE-2026-106606 Auth required
YITH YITH WooCommerce Affiliates - Insecure Deserialization
YITH YITH WooCommerce Affiliates <= 3.31.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-105885 Auth required
10Web Slider - Insecure Deserialization
10Web Slider by 10Web <= 1.2.62 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.