High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 238 of 568

  • 7.5 /10 High
    CVE-2026-92174 Auth required

    SiteOrigin Widgets Bundle - Local File Inclusion

    SiteOrigin Widgets Bundle plugin for WordPress <= 1.73.2 contains a local file inclusion caused by improper validation of the 'theme' parameter in /wp-json/sowb/v1/widgets/previews, letting authenticated contributors include and execute arbitrary PHP files, exploit requires crafted widgetData payload with legacy theme key and non-empty columns array.

  • 7.5 /10 High
    CVE-2026-91828 No auth

    OMGF WordPress Plugin - Denial of Service

    OMGF WordPress plugin < 6.3.11 contains a denial of service caused by unauthenticated slow server-side loopback requests, letting unauthenticated attackers exhaust PHP worker pool and make the site unavailable, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-90438 No auth

    Ninja Forms - Stored Cross-Site Scripting

    Ninja Forms WordPress plugin <= 3.15.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Paragraph Text (RTE) field, letting unauthenticated attackers inject scripts executed on user page access, exploit requires RTE enabled on Paragraph Text field.

  • 7.2 /10 High
    CVE-2026-87920 No auth

    W3 Total Cache WordPress Plugin - Stored XSS

    W3 Total Cache WordPress plugin <= 2.10.6 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content via output-buffer regex rewrite, letting unauthenticated attackers inject scripts, exploit requires 'Remove query strings from static resources' option enabled.

  • 7.5 /10 High
    CVE-2026-85494 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains multiple vulnerabilities including improper length parameter handling, uncaught exceptions, inefficient algorithmic complexity, excessive memory allocation, and insecure resource initialization, letting attackers cause denial of service or resource exhaustion, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-85215 Auth required

    GG Soft Software Services Inc. Paperwork - SQL Injection

    GG Soft Software Services Inc. Paperwork <= 2026-09-09 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 7.7 /10 High
    CVE-2026-82044 Auth required

    UTMStack - Server-Side Request Forgery

    UTMStack < 11.2.16 contains a server-side request forgery caused by unvalidated URL parameter in PdfService.downloadPdf() method via GET /api/generate-pdf-report, letting authenticated attackers access internal resources and sensitive data.

  • 8.8 /10 High
    CVE-2026-82039 Auth required

    UTMStack - SQL Injection

    UTMStack before 11.2.16 contains a sql injection caused by unsanitized assetType and groupName values in UtmAssetGroupService.searchQueryBuilder(), letting authenticated attackers execute arbitrary SQL with DBA privileges via GET /api/utm-asset-groups/searchGroupsByFilter.

  • 7.4 /10 High
    CVE-2026-80443 No auth

    HAVELSAN Inc. Sef - AI Chatbot Platform - Man-in-the-Middle

    HAVELSAN Inc. Sef - AI Chatbot Platform < 2.1 contains an insecure certificate validation vulnerability caused by improper validation, letting adversaries perform man-in-the-middle attacks, exploit requires network access to intercept communications.

  • 8.8 /10 High
    CVE-2026-80298 Auth required

    HAVELSAN Inc. Sef - AI Chatbot Platform - SQL Injection

    HAVELSAN Inc. Sef - AI Chatbot Platform < 2.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-67989 No auth

    crmne/ruby_llm - Denial of Service

    crmne/ruby_llm contains a regular expression denial-of-service caused by polynomial-time regex in Mistral model capability matching on Ruby 3.1.x, letting attackers cause denial of service, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-66055 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains an allocation of resources without limits or throttling vulnerability, letting attackers exhaust system resources, exploit requires no special conditions.

  • 8.7 /10 High
    CVE-2026-63772 No auth

    Apache Thrift - Denial of Service

    Apache Thrift < 0.25.0 contains an allocation of resources without limits or throttling vulnerability caused by lack of resource management in Go bindings, letting attackers exhaust resources, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-63578 No auth

    Legion of the Bouncy Castle Inc. bc-csharp - Denial of Service

    Legion of the Bouncy Castle Inc. bc-csharp < 2.7.0 contains a denial of service caused by unbounded iteration count in password-based private-key decryption (PbeUtilities.GenerateCipherParameters), letting attackers cause CPU exhaustion via crafted encrypted private keys, exploit requires supplying a crafted encrypted private key.

  • 8.2 /10 High
    CVE-2026-63577

    Legion of the Bouncy Castle Inc. bc-csharp - Authentication Bypass

    Legion of the Bouncy Castle Inc. bc-csharp < 2.7.0 contains an improper certificate validation vulnerability caused by incorrect directoryName name-constraint checks in PkixNameConstraintValidator.WithinDNSubtree, letting attackers with control over name-constrained intermediate CAs bypass PKIX path validation, exploit requires attacker to control or have certificates issued by a name-constrained intermediate CA.