High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 243 of 568

  • 8.8 /10 High
    CVE-2026-103625 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 154.0.8037.97 contains a remote code execution caused by type confusion in V8 engine, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-103624

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free vulnerability in Contextual Tasks, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 8.8 /10 High
    CVE-2026-103623 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free caused by improper memory handling in MediaStream, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-103622 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free vulnerability in SVG, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 7.3 /10 High
    CVE-2026-103552 No auth

    Apache Directory LDAP API - Denial of Service

    Apache Directory LDAP API >= 1.2.0 < 1.2.9 contains a stack overflow caused by processing deeply nested search filters in the server's decoder, letting remote attackers cause denial of service, exploit requires sending crafted nested filters.

  • 7.2 /10 High
    CVE-2026-103426 No auth

    Relevanssi Premium WordPress - Stored XSS

    Relevanssi Premium WordPress plugin <= 2.31.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the '_rt' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires click-tracking and logging enabled.

  • 7.5 /10 High
    CVE-2026-103098

    Generic Application - Information Disclosure

    An application transmits a sensitive key in the URL over an unencrypted HTTP connection, letting attackers intercept the key via network traffic, exploit requires network access to monitor traffic.

  • 7.5 /10 High
    CVE-2026-103097 No auth

    Android Application - Hardcoded Credentials

    An Android application contains hardcoded API keys retrievable from the application package, letting unauthorized users extract and misuse sensitive credentials, exploit requires reverse engineering the app.

  • 7.5 /10 High
    CVE-2026-103096 No auth

    Android Application - Hardcoded Credentials

    An Android application contains a hardcoded API key in the application package, allowing attackers who reverse engineer the app to retrieve and misuse the key, exploit requires access to the application package.

  • 7.2 /10 High
    CVE-2026-102772 No auth

    CMB2 WordPress Plugin - Stored Cross-Site Scripting

    CMB2 WordPress plugin <= 2.13.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in '<textarea_code field id>' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires public exposure of CMB2 form with textarea_code field.

  • 7.5 /10 High
    CVE-2026-102731 No auth

    Apache Directory LDAP API - Denial of Service

    Apache Directory LDAP API 1.2.0 to < 1.2.9 contains a denial of service caused by excessive memory allocation from small BER-encoded responses, letting attackers cause OutOfMemoryError and service disruption, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-102565 No auth

    BA Book Everything WordPress Plugin - Stored XSS

    BA Book Everything WordPress plugin <= 1.8.28 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'booking_service_qty' parameter, letting unauthenticated attackers inject scripts executed by admin users, exploit requires admin to view injected order.

  • 7.7 /10 High
    CVE-2026-101104 Auth required

    Meari IoT Cloud Platform - Broken Access Control

    Meari IoT Cloud Platform OpenAPI Service contains an authorization flaw caused by improper ownership verification, letting authenticated users manipulate configurations of devices they do not own, exploit requires user authentication.

  • 7.2 /10 High
    CVE-2026-10026 Auth required

    CTX Feed Pro WordPress - Code Injection

    CTX Feed Pro WordPress plugin <= 7.6.12 contains a code injection caused by insufficient input validation on the 'Feed Config' field passed to eval(), letting authenticated administrators execute arbitrary PHP code on the server.

  • 7.2 /10 High
    CVE-2026-100182 No auth

    Download Monitor WordPress Plugin - Stored XSS

    Download Monitor WordPress plugin <= 5.2.10 contains a stored XSS caused by insufficient input sanitization and output escaping in postMessage to Admin Editor, letting unauthenticated attackers inject scripts via tricking an admin, exploit requires admin interaction.