High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 230 of 568
- 8.4 /10 HighCVE-2026-104706 Auth required
DigitalCanion Portal - Path Traversal
DigitalCanion portal contains a path traversal vulnerability caused by improper input validation in Administration -> View Logs menu, letting remote attackers view or download sensitive system files, exploit requires network access.
- 7.6 /10 HighCVE-2026-104408 Auth required
Groundhogg Groundhogg - SQL Injection
Groundhogg Groundhogg <= 4.8.3 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-104407 No auth
Blubrry Podcasting PowerPress Podcasting - Cross-Site Request Forgery
Blubrry Podcasting PowerPress Podcasting <= 11.17.9 contains a cross site request forgery caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.
- 8.5 /10 HighCVE-2026-104389 Auth required
Sirv Sirv - SQL Injection
Sirv Sirv <= 8.2.5 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.
- 7.5 /10 HighCVE-2026-103507 Auth required
Perforce P4 Search - Unrestricted File Upload
Perforce P4 Search < 2026.4.2 contains an unrestricted file write vulnerability caused by insufficient path restrictions in the logging configuration interface, letting attackers with service authentication token write arbitrary files, exploit requires service authentication token.
- 7.2 /10 HighCVE-2026-103349 Auth required
Rymera Web Co Product Feed PRO for WooCommerce - Insecure Deserialization
Rymera Web Co Product Feed PRO for WooCommerce <= 13.5.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.2 /10 HighCVE-2026-103348 Auth required
Smackcoders Inc. WP Ultimate Exporter - Insecure Deserialization
Smackcoders Inc. WP Ultimate Exporter <= 3.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-103334 No auth
Etoile Web Design Incorporated Five Star Restaurant Reservations - Information Disclosure
Etoile Web Design Incorporated Five Star Restaurant Reservations <= 2.7.24 contains an insertion of sensitive information into sent data vulnerability, letting attackers retrieve embedded sensitive data, exploit requires crafted input.
- 8.5 /10 HighCVE-2026-103066 Auth required
WP BASE Booking - SQL Injection
WP BASE Booking <= 6.4.0 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-102775 No auth
Phoca Cart - Authorization Bypass
Phoca Cart 5.0.0 - 6.1.8 contains an authorization bypass caused by lack of proper verification of download tokens in the order-file download endpoint, letting remote attackers download any customer's digital goods by supplying arbitrary tokens, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-102282 PoC publicAuth required
adm-zip - Privilege Escalation
adm-zip < 0.6.1 contains a privilege escalation caused by applying unfiltered Unix permission bits including setuid/setgid during extraction with keepOriginalPermission=true, letting attackers gain root execution via crafted zip, exploit requires extraction as root.
- 7.3 /10 HighCVE-2026-102262 PoC publicAuth required
Newell Brands DYMO ID - Remote Code Execution
Newell Brands DYMO ID 1.5.1.71 contains a code execution vulnerability caused by resolving plugin Modules directory relative to the process working directory, letting attackers execute code at victim's privilege level when a malicious job file is opened.
- 8.8 /10 HighCVE-2026-101919 Auth required
HyperShift Operator - Remote Code Execution
HyperShift operator contains a remote code execution caused by copying user-provided kubeconfig secrets without validation into privileged control plane namespace, letting authenticated users with cluster and secret creation permissions execute arbitrary code, exploit requires cluster and secret creation permissions.
- 7.1 /10 HighCVE-2026-100515 No auth
VillaTheme Photo Reviews for WooCommerce - Reflected XSS
VillaTheme Photo Reviews for WooCommerce <= 1.2.30 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires crafted request.
- 8.8 /10 HighCVE-2026-100511 Auth required
Vektor Inc. VK Google Job Posting Manager - Insecure Deserialization
Vektor Inc. VK Google Job Posting Manager <= 1.3.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.