High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 231 of 568

  • 7.2 /10 High
    CVE-2026-100506 Auth required

    WP Spell Check - Insecure Deserialization

    WP Spell Check contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-0461

    AMD Zynq UltraScale+ MPSoC & RFSoC - Buffer Overflow

    AMD Zynq UltraScale+ MPSoC and RFSoC devices contain a buffer overflow caused by insufficient boundary validation in USB boot mode DFU download requests, letting attackers execute unauthorized code during boot, exploit requires USB boot mode access.

  • 7.1 /10 High
    CVE-2025-15643 No auth

    Jose Fernandez Adsmonetizer - Reflected XSS

    Jose Fernandez Adsmonetizer <= 3.2.4 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts via crafted input, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2019-25777 No auth

    YAML Perl - Remote Code Execution

    YAML for Perl < 1.27_001 contains a code injection vulnerability caused by unrestricted perl/glob document loading, letting attackers execute arbitrary Perl code remotely, exploit requires supplying crafted documents in the same process.

  • 7.5 /10 High
    CVE-2026-97307 No auth

    StylemixThemes Cost Calculator Builder - Information Disclosure

    StylemixThemes Cost Calculator Builder <= 4.0.17 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information remotely, exploit requires crafted requests.

  • 7.1 /10 High
    CVE-2026-97276 No auth

    VeronaLabs WP Statistics - Reflected XSS

    VeronaLabs WP Statistics <= 14.16.14 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-93549 No auth

    CoCart WordPress plugin - Cross-Site Request Forgery

    CoCart WordPress plugin < 4.9.7 contains a cross-site request forgery vulnerability caused by improper scoping of REST API authentication filter, letting attackers create new administrator accounts via logged-in admin sessions.

  • 7.5 /10 High
    CVE-2026-88779 CISA KEV

    CVE-2026-88779

    Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

  • 7.4 /10 High
    CVE-2026-105222

    alexpechkarev/google-maps - Man-in-the-Middle

    alexpechkarev/google-maps Laravel package through 12.16 contains a man-in-the-middle vulnerability caused by disabling TLS certificate verification via ssl_verify_peer set to FALSE, letting on-path attackers intercept requests, steal API keys, and tamper with responses, exploit requires network interception capability.

  • 7.4 /10 High
    CVE-2026-105221 PoC public

    Gist RubyGem - Improper Certificate Validation

    Gist RubyGem < 6.1.0 contains an improper certificate validation vulnerability caused by VERIFY_NONE setting in http_connection in lib/gist.rb, letting on-path attackers intercept and modify HTTPS traffic, exploit requires network interception capability.

  • 7.8 /10 High
    CVE-2026-105220 No auth

    Twine 2 desktop - Stored XSS

    Twine 2 desktop <= 2.12.0 contains a stored XSS caused by execution of markup from imported story files in importStories(), letting attackers execute code as the user via crafted story files, exploit requires opening malicious story files.

  • 7.5 /10 High
    CVE-2026-105219 No auth

    Mammoth.js - Denial of Service

    Mammoth.js > 1.3.0 < 1.12.3 contains a denial of service caused by overlapping regex alternatives in the style map tokeniser in lib/styles/parser/tokeniser.js, letting attackers block the Node.js event loop by supplying crafted .docx files.

  • 7.4 /10 High
    CVE-2026-105218 No auth

    gopay - Man In The Middle

    gopay before 1.5.119 contains a man-in-the-middle vulnerability caused by disabled TLS certificate verification in defaultClient() in pkg/xhttp/client.go, letting attackers impersonate payment provider APIs and intercept or modify sensitive data, exploit requires network access.

  • 7.4 /10 High
    CVE-2026-105216 No auth

    go-micro - Man-in-the-Middle

    go-micro < 6.0.0 contains a man-in-the-middle vulnerability caused by improper certificate validation with InsecureSkipVerify set to true by default, letting network attackers intercept or modify service traffic, exploit requires network access.

  • 8.2 /10 High
    CVE-2026-105213 No auth

    ZITADEL - Authentication Bypass

    ZITADEL < 4.17.1 contains a broken authentication caused by not checking an organization's inactive state during Login V2, letting users of deactivated organizations sign in and obtain tokens, exploit requires valid user credentials or session.