High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 244 of 568
- 7.2 /10 HighCVE-2026-100107 No auth
Kubio AI Page Builder - Stored XSS
Kubio AI Page Builder WordPress plugin <= 2.9.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts executed on page access.
- 7.5 /10 HighCVE-2020-37278 CISA KEVNo auth
Weaver e-Bridge - Arbitrary File Read & Server-Side Request Forgery
Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability caused by improper validation of the downloadUrl parameter in the saveYZJFile endpoint, letting remote attackers read sensitive files and perform server-side request forgery, exploit requires no authentication.
- 7.5 /10 HighCVE-2014-125130 CISA KEVNo auth
CodeArt Google MP3 Audio Player - Path Traversal
CodeArt Google MP3 Audio Player plugin for WordPress through 1.0.11 contains a path traversal vulnerability caused by insufficient validation of the file parameter in direct_download.php, letting remote attackers read arbitrary files without authentication.
- 8.2 /10 HighCVE-2026-97662 No auth
AWS security-agent-mcp-server - Arbitrary File Write
AWS security-agent-mcp-server < 0.2.0 contains a file write vulnerability caused by argument injection in the diff scan operation, letting context-dependent threat actors create, overwrite, or truncate arbitrary files outside the intended workspace, exploit requires crafted reference value.
- 7.2 /10 HighCVE-2026-97661 No auth
Business Essentials for Contact Form 7 - Stored XSS
Business Essentials for Contact Form 7 WordPress plugin <= 1.2.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'gateway' form field, letting unauthenticated attackers execute arbitrary scripts, exploit requires Payments module enabled and form configured for PayPal and Stripe.
- 7.6 /10 HighCVE-2026-97297 Auth required
Gratisfaction - Broken Access Control
Gratisfaction <= 4.6.3 contains a broken access control vulnerability, letting attackers bypass authorization and access restricted resources, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-97284 Auth required
Icegram - PHP Object Injection
Icegram <= 3.1.31 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.
- 7.6 /10 HighCVE-2026-97277 Auth required
Social Boost - Broken Access Control
Social Boost <= 3.6.2 contains a broken access control vulnerability, letting attackers bypass authorization and access restricted resources, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-97273 No auth
Premmerce Wishlist for WooCommerce - Reflected XSS
Premmerce Wishlist for WooCommerce <= 1.1.13 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-97268 No auth
Premmerce Wishlist for WooCommerce - Reflected XSS
Premmerce Wishlist for WooCommerce <= 1.1.13 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-97260 No auth
MaxGalleria - Reflected XSS
MaxGalleria <= 6.5.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-96813 No auth
Form Maker by 10Web - Stored XSS
Form Maker by 10Web WordPress plugin <= 1.15.47 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Mark on Map Longitude/Latitude fields, letting unauthenticated attackers inject scripts executed on page access.
- 7.1 /10 HighCVE-2026-96577
oc-mirror - Broken Access Control
oc-mirror contains an unrestricted network binding in the embedded local cache registry, letting unauthenticated adjacent network attackers push tampered images, delete cache, or access mirrored content, exploit requires network adjacency.
- 7.2 /10 HighCVE-2026-96573
Appointment Hour Booking – Booking Calendar - Stored XSS
Appointment Hour Booking – Booking Calendar WordPress plugin <= 1.5.97 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in Booking Form Single-Line Field via Schedule Calendar List Renderer, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires 'list_readmore_numberofwords' setting configured with a positive integer.
- 7.2 /10 HighCVE-2026-96561 No auth
AI Engine – The Chatbot, AI Framework & MCP for WordPress - Stored XSS
AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin <= 3.8.0 contains a stored cross-site scripting caused by improper input neutralization and output escaping in REST endpoint and dashboard widget, letting unauthenticated attackers execute arbitrary scripts in admin dashboard, exploit requires no authentication.