High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 235 of 568
- 8.2 /10 HighCVE-2026-71886 No auth
Bouncy Castle - Broken Access Control
Bouncy Castle for Java < 1.86 contains a broken access control vulnerability caused by improper validation of certification key flags in OpenPGP certificate API, letting attackers with compromised subkeys issue unauthorized certifications or trust delegations, exploit requires compromised subkey.
- 8.2 /10 HighCVE-2026-71883
Bouncy Castle - Information Disclosure
Bouncy Castle for Java LTS before 2.73.13 contains an information disclosure vulnerability caused by improper JNI ReleaseByteArrayElements usage in native packet ciphers, letting attackers obtain raw AES keys when encrypting in place, exploit requires using affected native ciphers with in-place encryption.
- 8.8 /10 HighCVE-2026-18443 Auth required
Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management - SQL Injection
Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress <= 8.97.0 contains a SQL injection caused by insufficient escaping of 'access_privileges' parameter, letting authenticated subscriber-level attackers extract sensitive database information, exploit requires specific admin deny-list configuration.
- 8.6 /10 HighCVE-2026-105115 No auth
OpenAM - Insecure Deserialization
OpenAM before 16.1.3 contains an insecure deserialization vulnerability in the legacy JAX-RPC SOAP interface, letting remote attackers instantiate arbitrary classes without authentication, exploit requires sending crafted SOAP requests.
- 7.1 /10 HighCVE-2026-104478 Auth required
Formwork - Path Traversal
Formwork < 2.3.13 contains a path traversal caused by base64-encoded backslash-separated traversal payload in BackupController, letting authenticated panel users read or delete arbitrary files, exploit requires backup download or delete permission.
- 7.5 /10 HighCVE-2026-104433 No auth
Mooncake Transfer Engine - Denial of Service
Mooncake transfer engine < 0.3.12 contains an out-of-bounds read caused by improper handling of zero-length handshake frames in readString function, letting unauthenticated attackers crash the service remotely.
- 7.5 /10 HighCVE-2026-103913 No auth
GeoDirectory WordPress Plugin - SQL Injection
GeoDirectory WordPress plugin <= 2.8.186 contains a SQL injection caused by insufficient escaping and lack of numeric validation on stored latitude/longitude coordinates, letting authenticated attackers with Subscriber-level access extract sensitive database information.
- 7.5 /10 HighCVE-2026-103514 Auth required
WP 2FA WordPress plugin - Authentication Bypass
WP 2FA WordPress plugin < 4.1.0 contains a broken authentication caused by failure to invalidate time-based one-time passcodes after use, letting attackers replay valid codes to bypass two-factor authentication, exploit requires attacker to know account password and observe valid code.
- 7.1 /10 HighCVE-2026-103342 No auth
Unlimited Elements Unlimited Elements For Elementor - Reflected XSS
Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.20 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.
- 8.2 /10 HighCVE-2026-103065 No auth
Themeum Kirki - Broken Access Control
Themeum Kirki <= 6.3.1 contains an access control vulnerability caused by improper validation of specified quantity in input, letting attackers access functionality not properly constrained by ACLs, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-101928 No auth
Magic Tooltips For Contact Form 7 - Stored XSS
Magic Tooltips For Contact Form 7 WordPress plugin <= 1.0.34 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of the 'author' parameter, letting unauthenticated attackers inject scripts executed when users access injected pages.
- 8.1 /10 HighCVE-2026-101923 No auth
Photo Reviews for WooCommerce - Broken Access Control
Photo Reviews for WooCommerce WordPress plugin <= 1.2.30 contains an arbitrary content deletion vulnerability caused by improper validation of post IDs in wcpr_image_upload_id parameter, letting unauthenticated attackers delete arbitrary posts when an admin deletes their review.
- 7.5 /10 HighCVE-2026-101161 PoC publicNo auth
WP Ultimate Review WordPress - Denial of Service
WP Ultimate Review WordPress plugin < 2.4.4 contains a denial of service caused by unauthenticated users storing crafted review content, letting attackers cause persistent fatal errors on reviewed pages, exploit requires review display settings never saved.
- 7.5 /10 HighCVE-2026-101160 PoC publicNo auth
WP Ultimate Review - Denial of Service
WP Ultimate Review WordPress plugin < 2.4.4 contains a denial of service caused by lack of numeric validation on submitted review ratings, letting unauthenticated users cause fatal errors, exploit requires user reviews enabled.
- 7.5 /10 HighCVE-2026-101159 No auth
WP Ultimate Review - Stored XSS
WP Ultimate Review WordPress plugin < 2.4.4 contains a stored cross-site scripting caused by improper sanitization and escaping of reviews submitted via public review form, letting unauthenticated attackers execute scripts on users viewing the review page, exploit requires user reviews to be enabled.