High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 236 of 568
- 7.2 /10 HighCVE-2026-97663 No auth
WooCommerce Customer Reviews - Stored XSS
WooCommerce Customer Reviews plugin for WordPress <= 5.122.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the comment author name, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires image attachment feature enabled.
- 7.2 /10 HighCVE-2026-97641 No auth
Relevanssi – A Better Search - Stored XSS
Relevanssi – A Better Search WordPress plugin <= 4.28.3 contains a stored XSS caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers inject scripts, exploit requires non-empty allowable tags in excerpts setting.
- 7.5 /10 HighCVE-2026-97363 No auth
WebSocket Application Programming Interface - Authentication Bypass
WebSocket Application Programming Interface contains a broken authentication caused by lack of rate limiting on authentication requests, letting attackers perform denial-of-service or brute-force attacks, exploit requires no special conditions.
- 7.2 /10 HighCVE-2026-97342 No auth
JetFormBuilder - Stored XSS
JetFormBuilder WordPress plugin <= 3.6.5.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'choice' Post Meta via Insert/Update Post action, letting unauthenticated attackers inject and execute arbitrary scripts when users access affected pages.
- 7.2 /10 HighCVE-2026-97336 No auth
CMB2 WordPress Plugin - Stored XSS
CMB2 WordPress plugin <= 2.13.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'file_list' field type, letting unauthenticated attackers inject scripts executed on user page access, exploit requires a publicly accessible front-end form or user meta box with file_list field.
- 7.3 /10 HighCVE-2026-97212 No auth
WebSocket Backend - Authentication Bypass & Denial of Service
WebSocket backend uses predictable session identifiers caused by allowing multiple endpoints to connect with the same session ID, letting unauthorized users authenticate as others or cause denial of service, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-96990 No auth
Apache Thrift - Denial of Service
Apache Thrift < 0.25.0 contains an allocation of resources without limits or throttling vulnerability in Erlang bindings, letting attackers exhaust resources, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-96940 PoC publicAuth required
Microsoft Exchange Server - Broken Access Control
Microsoft Exchange Server contains a broken access control vulnerability caused by weak authorization, letting authenticated attackers elevate privileges over a network, exploit requires attacker authentication.
- 7.2 /10 HighCVE-2026-96871 No auth
Mang Board WordPress Plugin - Stored XSS
Mang Board WordPress plugin <= 2.4.2 contains a stored XSS caused by insufficient sanitization and escaping of 'data_type' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires default board settings.
- 7.2 /10 HighCVE-2026-96578 No auth
GSpeech TTS – WordPress Text To Speech Plugin - Stored XSS
GSpeech TTS – WordPress Text To Speech Plugin <= 3.22.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers execute arbitrary scripts when users access injected pages.
- 7.2 /10 HighCVE-2026-96567 No auth
MW WP Form WordPress Plugin - Stored XSS
MW WP Form WordPress plugin <= 5.1.7 contains a stored XSS caused by insufficient sanitization and escaping of the 'post_id' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-96566 No auth
The Newsletter WordPress Plugin - Stored XSS
The Newsletter WordPress plugin <= 9.4.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'np1' custom field parameter, letting unauthenticated attackers inject scripts executed when users access injected pages, exploit requires no authentication or capability checks.
- 7.2 /10 HighCVE-2026-95817 No auth
DoFollow Case by Case WordPress plugin - Stored XSS
DoFollow Case by Case WordPress plugin <= 3.6.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers execute arbitrary scripts in users' browsers, exploit requires administrator approval of malicious comments.
- 7.2 /10 HighCVE-2026-95670 No auth
No External Links WordPress plugin - Stored XSS
No External Links WordPress plugin <= 5.2.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in /goto/{base64} redirect, letting unauthenticated attackers execute arbitrary scripts, exploit requires 'Link Encoding: Base64' option enabled.
- 8.2 /10 HighCVE-2026-94653 No auth
Apache Thrift - Denial of Service
Apache Thrift PHP bindings before 0.25.0 contain an inefficient algorithmic complexity vulnerability caused by suboptimal algorithm implementation, letting attackers cause denial of service via resource exhaustion, exploit requires crafted input.