High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 16 of 725

  • 7.2 /10 High
    CVE-2026-90437 No auth

    Gravity Forms - Stored XSS

    Gravity Forms WordPress plugin <= 3.1.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Post Excerpt, Post Custom Field, and Rich-Text Paragraph fields, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.

  • 8.8 /10 High
    CVE-2026-89435 Auth required

    Formidable Forms WordPress Plugin - Unrestricted File Upload

    Formidable Forms WordPress plugin <= 6.35 contains an arbitrary plugin installation vulnerability caused by insufficient URL prefix validation and weak permission checks, letting authenticated attackers with subscriber-level access install plugins, exploit requires free-only site without Formidable Pro.

  • 7.1 /10 High
    CVE-2026-86715

    Crypttech Vatos DLP - Authentication Bypass

    Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP 1.1.176 < 1.1.243 contains a plaintext password storage vulnerability caused by insecure credential storage, letting attackers use known domain credentials, exploit requires access to stored credentials.

  • 8.7 /10 High
    CVE-2026-85268 No auth

    Google Cloud Identity Platform & Firebase Authentication - Stored XSS

    Google Cloud Identity Platform and Firebase Authentication < 2026-08-14 on iOS contain a stored XSS caused by improper sanitization of iOS bundle ID in auth/handler, letting unauthenticated remote attackers execute arbitrary JavaScript.

  • 7.0 /10 High
    CVE-2026-84243

    GNU C Library - Command Injection

    GNU C Library >= 2.0 contains a command injection caused by unsafe handling of LANGUAGE environment variable in gettext functions, letting attackers load crafted message catalogs to execute arbitrary code, exploit requires attacker to set LANGUAGE and select a non-C locale.

  • 8.8 /10 High
    CVE-2026-78527 Auth required

    GS Testimonial Slider - PHP Object Injection

    GS Testimonial Slider <= 3.3.10 contains a PHP Object Injection caused by unsafe unserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 7.8 /10 High
    CVE-2026-78402 Auth required

    Thales Sentinel Keys Server - Buffer Overflow

    Thales Sentinel Keys Server < 1.3.8.0 contains a stack-based buffer overflow and out-of-bounds write caused by unchecked length of the first field in input messages, letting local attackers execute code as NT AUTHORITY\SYSTEM, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-76031 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.79 contains a use after free caused by improper memory handling in input processing, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-76030 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.79 contains a memory corruption vulnerability in FileSystem, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires crafted HTML content.

  • 8.8 /10 High
    CVE-2026-76029 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.79 contains a memory corruption vulnerability in Network, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-76028 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.79 contains a use after free caused by improper memory handling in FileSystem, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-76026 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.79 contains a memory corruption vulnerability in Autofill, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-76025 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.79 contains a use after free caused by improper memory handling in FileSystem, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 7.5 /10 High
    CVE-2026-76012 Auth required

    NextGEN Gallery - Remote Code Execution

    NextGEN Gallery WordPress plugin <= 4.4.1 contains a remote code execution caused by broken authorization and unsafe file upload in legacy_render function, letting authenticated attackers with custom-level access execute code, exploit requires attacker to be stored author of at least one gallery.

  • 8.5 /10 High
    CVE-2026-75882 Auth required

    ESET Endpoint Encryption & Full Disk Encryption - Broken Access Control

    ESET Endpoint Encryption and ESET Full Disk Encryption contain an improper access control vulnerability caused by insufficient permission checks in a privileged kernel driver interface, letting attackers with standard user permissions send crafted requests.