High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 234 of 568

  • 7.2 /10 High
    CVE-2026-93430 No auth

    GD Rating System WordPress Plugin - Stored XSS

    GD Rating System WordPress plugin <= 3.7.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'title' and 'url' Render Args in gdrts_live_handler AJAX, letting unauthenticated attackers inject scripts executed by users, exploit requires nonce obtainable from page source.

  • 7.5 /10 High
    CVE-2026-93428 No auth

    Ultimate Member - Authorization Bypass

    Ultimate Member WordPress plugin <= 2.13.1 contains an authorization bypass caused by improper user authorization verification in wp_ajax_nopriv_um_get_members endpoint, letting unauthenticated attackers view privacy-restricted member profile fields, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-92977 No auth

    Real Cookie Banner - Stored XSS

    Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress <= 5.3.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comments, letting unauthenticated attackers inject scripts executed when users access the page, exploit requires comment moderation approval.

  • 8.8 /10 High
    CVE-2026-92536 Auth required

    ProfilePress WordPress Plugin - Information Disclosure

    ProfilePress WordPress plugin <= 4.17.4 contains a sensitive information exposure caused by improper handling of user profile data in get_user_profile_structure, letting authenticated attackers with subscriber access and unauthenticated attackers extract user emails, login names, and registration dates via crafted shortcodes, exploit requires subscriber access or enabled users_can_register option.

  • 8.2 /10 High
    CVE-2026-91078 No auth

    TillKit WordPress - Authentication Bypass

    TillKit WordPress plugin < 1.0.5 contains a broken authentication caused by use of a hard-coded PIN for privileged POS account, letting unauthenticated attackers obtain privileged sessions to read and modify data, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-89236 No auth

    SaveTo Wishlist Lite WordPress - SQL Injection

    SaveTo Wishlist Lite WordPress plugin < 1.1.5 contains a SQL injection caused by unsanitized parameters in the ORDER BY clause, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-88783 No auth

    Kubio AI Page Builder WordPress - Stored XSS

    Kubio AI Page Builder WordPress plugin < 2.9.3 contains a stored XSS caused by improper limitation of allowed HTML elements filtering, letting unauthenticated attackers execute scripts in visitors' or admins' browsers, exploit requires unauthenticated content submission.

  • 7.2 /10 High
    CVE-2026-87091 No auth

    Welcart e-Commerce - Stored Cross-Site Scripting

    Welcart e-Commerce plugin for WordPress <= 2.12.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Settlement Notification Parameters, letting unauthenticated attackers inject scripts executed in admin views, exploit requires no authentication or validation.

  • 8.2 /10 High
    CVE-2026-85515 No auth

    Bouncy Castle Java - Broken Authentication

    Bouncy Castle for Java < 1.86 contains a missing truncation error caused by improper handling of truncated OpenPGP encrypted messages in SEIPD version 1 and AEAD paths, letting attackers bypass integrity checks and obtain altered plaintext without error, exploit requires truncated message input.

  • 7.5 /10 High
    CVE-2026-75028 Auth required

    WPCafe WordPress Plugin - Local File Inclusion

    WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin <= 3.0.18 contains a local file inclusion caused by the template scope function, letting authenticated contributors and above execute arbitrary PHP files, exploit requires contributor-level access.

  • 7.1 /10 High
    CVE-2026-71891

    Bouncy Castle - Broken Access Control

    Bouncy Castle for Java < 1.86 contains a broken access control caused by improper validation of public keys on non-canonical ECCurves in BLS12_381BasicScheme, letting attackers forge phantom signers in aggregate signature verification, exploit requires application to accept ECPoints on explicit non-canonical curves.

  • 8.7 /10 High
    CVE-2026-71890 No auth

    Bouncy Castle - Broken Access Control

    Bouncy Castle for Java < 1.86 contains a broken access control vulnerability caused by improper validation of MLS external commit Remove proposals in Group.validateExternalCachedProposals, letting external joiners evict arbitrary group members and take over their slots, exploit requires crafted external commit with Remove proposal.

  • 8.7 /10 High
    CVE-2026-71889 No auth

    Bouncy Castle - Broken Access Control

    Bouncy Castle for Java < 1.86 and LTS < 2.73.13 contain a broken access control vulnerability caused by improper application of X.509 name constraints in PKIXCertPathReviewer, letting attackers bypass certificate path validation, exploit requires use of PKIXCertPathReviewer for trust decisions.

  • 8.7 /10 High
    CVE-2026-71888

    Bouncy Castle - Authentication Bypass

    Bouncy Castle for Java < 1.86 contains an authentication bypass caused by inconsistent handling of digestAlgorithm and authAttrs fields in CMS AuthenticatedData parser, letting attackers modify authenticated attributes without key access, exploit requires message modification in transit.

  • 8.2 /10 High
    CVE-2026-71887 No auth

    Bouncy Castle - Authentication Bypass

    Bouncy Castle for Java < 1.86 contains a broken authentication caused by improper validation of OpenPGP subkey binding signatures lacking embedded Primary Key Binding signatures, letting attackers misattribute genuine signatures to attacker-chosen identities, exploit requires attacker to have victim's public signing subkey.