High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 163 of 556
- 7.2 /10 HighCVE-2026-105872 Auth required
mklacroix Product Configurator for WooCommerce - Insecure Deserialization
mklacroix Product Configurator for WooCommerce <= 1.7.5 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-105870 No auth
Delight Star Inc. WP Associate Post R2 - Reflected XSS
Delight Star Inc. WP Associate Post R2 <= 5.0.1 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.
- 7.1 /10 HighCVE-2026-105318 No auth
Datasolution AcyMailing SMTP Newsletter - Reflected XSS
Datasolution AcyMailing SMTP Newsletter <= 11.1.0 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-105281 No auth
openPDC - Information Disclosure
openPDC contains an information disclosure vulnerability caused by unauthenticated network connections to the internal data publisher, letting unauthenticated attackers retrieve complete device and measurement topology, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-104635 No auth
elixir-protobuf protobuf - Denial of Service
elixir-protobuf protobuf >= 0.8.0 contains an uncontrolled recursion vulnerability caused by missing depth checks in Protobuf.JSON.Decode for self-referential or cyclic message types, letting unauthenticated remote attackers crash the decoding process via deeply nested JSON documents, exploit requires crafted deeply nested JSON input.
- 8.8 /10 HighCVE-2026-104629 Auth required
openPDC & openHistorian - Command Injection
openPDC and openHistorian contain a command injection caused by insecure component loading mechanism, letting authenticated attackers with file placement privileges execute arbitrary constructor code with service account privileges.
- 8.8 /10 HighCVE-2026-104392 Auth required
ExpressTech Quiz And Survey Master - Insecure Deserialization
ExpressTech Quiz And Survey Master <= 11.2.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-104084 Auth required
SmarterMail - Privilege Escalation
SmarterMail < 9777 contains a privilege escalation caused by JWT tokens embedding role claims that are not revalidated on refresh, letting attackers retain higher privileges by replaying stale tokens, exploit requires captured refresh token.
- 7.2 /10 HighCVE-2026-104082 PoC publicAuth required
SmarterMail - Remote Code Execution
SmarterMail before build 9777 contains a remote code execution caused by bypassing Volume Mount script-directory containment via domain-put endpoint, letting attackers with SysAdmin-scoped tokens execute SYSTEM-level code, exploit requires SysAdmin-scoped access token.
- 8.1 /10 HighCVE-2026-104081 Auth required
KodExplorer - Path Traversal & Stored XSS
KodExplorer < 4.55 contains a path traversal vulnerability caused by insufficient sanitization in unzip_pre_name() and lack of directory restriction in PclZip extract(), letting authenticated attackers overwrite files and execute remote code via crafted ZIP uploads.
- 8.8 /10 HighCVE-2026-103413 Auth required
Apache Camel Karavan - Broken Access Control
Apache Camel Karavan 4.0.0 to <4.22.1 contains an improper input validation vulnerability caused by unrestricted application of Kubernetes resources from unmarshalled kubernetes.yaml, letting authenticated users of any role apply arbitrary Kubernetes resources with elevated privileges, exploit requires user authentication.
- 8.8 /10 HighCVE-2026-103412 Auth required
Apache Camel Karavan - Path Traversal
Apache Camel Karavan >= 3.18.0 < 4.22.1 contains a path traversal caused by improper limitation of project file names in the project file API, letting authenticated users overwrite files and execute code, exploit requires authentication.
- 8.2 /10 HighCVE-2026-102554 No auth
Google Guava - Denial of Service
Google Guava 4.0 through 33.7.1 contains a denial of service caused by unthrottled resource allocation during deserialization of CompactHashMap, CompactHashSet, or MapMakerInternalMap, letting attackers cause memory exhaustion via crafted streams, exploit requires crafted serialization input.
- 8.8 /10 HighCVE-2025-15700 Auth required
AWP Classifieds WordPress plugin - Unrestricted File Upload
AWP Classifieds WordPress plugin < 4.4.9 contains an unrestricted file upload vulnerability caused by improper validation of files extracted from uploaded ZIP archives during listing-import, letting users with management capability upload arbitrary PHP files and achieve remote code execution.
- 7.2 /10 HighCVE-2026-97147 Auth required
OpenStack Mistral - Broken Access Control
OpenStack Mistral through 23.0.0 contains a broken access control vulnerability caused by improper resource resolution in v2 API write paths, letting authenticated project members modify other projects' resources, exploit requires authentication and API exposure.