High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 176 of 556

  • 8.2 /10 High
    CVE-2026-97714 No auth

    Secure Access - Authentication Denial of Service

    Secure Access servers < 14.60 contain a denial of service vulnerability caused by malformed response handling in the authentication sub-system, letting attackers cause persistent denial of service remotely, exploit requires network access.

  • 8.3 /10 High
    CVE-2026-97680 Auth required

    IBM Langflow OSS - Broken Access Control

    IBM Langflow OSS 1.0.0 through 1.12.2 contains an improper access control vulnerability in the vertex result caching subsystem, letting remote authenticated attackers obtain sensitive information or inject malicious data.

  • 8.8 /10 High
    CVE-2026-97679 Auth required

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-97678 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution caused by improper input validation, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-97676 Auth required

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a command injection caused by improper neutralization of special elements in code, letting remote authenticated attackers execute arbitrary code and escape sandbox.

  • 8.1 /10 High
    CVE-2026-97674 Auth required

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary OS commands.

  • 8.8 /10 High
    CVE-2026-97673 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution caused by improper input validation, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-97655 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution caused by an incomplete blocklist in the code security scanner, letting remote attackers execute arbitrary code, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-97188 No auth

    String locator WordPress plugin - Insecure Deserialization

    String locator WordPress plugin < 2.6.8 contains an insecure deserialization vulnerability caused by unrestricted classes during database row deserialization, letting unauthenticated attackers achieve remote code execution or data disclosure when an admin interacts with the data.

  • 7.5 /10 High
    CVE-2026-96335 No auth

    WPMU DEV Forminator - Broken Access Control

    WPMU DEV Forminator <= 1.57.2 contains a broken access control vulnerability caused by missing authorization checks, letting attackers exploit incorrectly configured access control security levels, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-95595 No auth

    Disable and Remove Google Fonts - Reflected XSS

    Disable and Remove Google Fonts | GDPR & DSGVO friendly <= 2.0.2 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-95534 Auth required

    Unlimited Elements Unlimited Elements For Elementor - Insecure Deserialization

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-94670 No auth

    Everest Forms - Reflected XSS

    Everest Forms <= 3.6.1 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request.

  • 7.1 /10 High
    CVE-2026-94662 No auth

    Unlimited Elements Unlimited Elements For Elementor - Stored XSS

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires no special privileges.

  • 7.6 /10 High
    CVE-2026-93678 Auth required

    IBM Langflow OSS - Broken Access Control

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a broken access control vulnerability caused by improper authorization, letting remote authenticated attackers obtain sensitive information.