High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 246 of 568
- 7.2 /10 HighCVE-2026-85679 No auth
Extendify WordPress plugin - Stored XSS
Extendify WordPress plugin <= 3.1.6 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'styles.blocks' block type key, letting unauthenticated attackers inject scripts executed on page access, exploit requires unauthenticated POST, PUT, or PATCH requests to /wp/v2/global-styles.
- 7.2 /10 HighCVE-2026-85235 No auth
Forminator Forms - Stored XSS
Forminator Forms WordPress plugin <= 1.57.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Rich-Text Textarea Field, letting unauthenticated attackers inject scripts executed when an admin interacts with the injected content.
- 8.8 /10 HighCVE-2026-82828 Auth required
Hitachi Coding Software Suite - Broken Access Control
Hitachi Coding Software Suite <= 3.3.0 contains an incorrect authorization vulnerability caused by improper access control, letting unprivileged users perform administrator-level operations, exploit requires unprivileged user access.
- 7.5 /10 HighCVE-2026-82826 No auth
Hitachi Coding Software Suite - Cleartext Transmission of Sensitive Information
Hitachi Coding Software Suite <= 3.3.0 contains a cleartext transmission of sensitive information vulnerability caused by unencrypted data transmission, letting attackers eavesdrop on authentication credentials and sensitive data in transit, exploit requires network access.
- 7.5 /10 HighCVE-2026-81809 No auth
Paytm Payment Gateway WordPress plugin - SQL Injection
Paytm Payment Gateway WordPress plugin < 2.8.9 contains a SQL injection caused by improper escaping of payment callback data and forgable integrity checks, letting unauthenticated attackers execute arbitrary SQL commands.
- 7.5 /10 HighCVE-2026-81739 No auth
Paytm Payment Gateway WordPress - Stored XSS
Paytm Payment Gateway WordPress plugin < 2.8.9 contains a stored XSS caused by unsanitized payment callback data and forged integrity checks, letting unauthenticated users execute scripts in admin sessions, exploit requires gateway enabled without credentials.
- 7.5 /10 HighCVE-2026-80276 No auth
Comelit Multi-User Gateway - Authentication Bypass
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 contain an information disclosure vulnerability caused by an unauthenticated network-accessible management interface, letting remote attackers read sensitive configuration data including the Remote Configuration Password in cleartext, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-80275 Auth required
Comelit Multi-User Gateway - Broken Access Control
Comelit Multi-User Gateway for VIP System (model 1456B) 2.9.1 and 2.10.0 contain a broken access control caused by missing server-side authorization on administrative password-change function, letting authenticated users overwrite administrator passwords, exploit requires user authentication.
- 7.9 /10 HighCVE-2026-79899 Auth required
Fortra BoKS Manager - Information Disclosure
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert caused by predictable temporary file creation without restrictive umask, letting local users access CA secret or host private keys, exploit requires local access to BOKS_tmp directory.
- 7.5 /10 HighCVE-2026-79896 No auth
Fortra BoKS Manager - Denial of Service
Fortra BoKS Manager contains an out-of-bounds read caused by a malformed TLS ClientHello in boks_portmux, letting remote unauthenticated attackers cause service interruption, exploit requires no special privileges.
- 8.4 /10 HighCVE-2026-73975 Auth required
djehuty - SQL Injection
djehuty < 26.3.2 contains a SPARQL injection caused by crafted session name in state-modifying queries, letting authenticated depositors write and delete arbitrary triples in the shared RDF store, exploit requires logged-in account.
- 7.3 /10 HighCVE-2026-73637 No auth
Apache HTTP Server - Authentication Bypass
Apache HTTP Server < 2.4.69 contains a use after free vulnerability in mod_auth_digest caused by concurrent Digest authentication requests with AuthDigestNcCheck enabled or AuthDigestNonceLifetime set to 0, letting unauthenticated remote clients cause authentication state corruption.
- 8.1 /10 HighCVE-2026-73636
Apache HTTP Server - Authentication Bypass
Apache Software Foundation Apache HTTP Server 2.4.x contains an authentication bypass caused by replaying captured digest authentication credentials via crafted requests triggering garbage collection in mod_auth_digest, letting man-in-the-middle attackers bypass authentication, exploit requires AuthDigestNonceLifetime set to 0.
- 8.8 /10 HighCVE-2026-70650 No auth
GetSimple CMS - Stored XSS
GetSimple CMS CE <= 3.3.22 contains a stored XSS caused by improper re-encoding in the page backup viewer (admin/backup-edit.php), letting authenticated users execute JavaScript in admin browsers, exploit requires page edit privileges.
- 7.5 /10 HighCVE-2026-68496 No auth
FasterXML jackson-dataformats-binary - Denial of Service
FasterXML jackson-dataformats-binary < 2.16.0 contains a denial of service caused by missing maxNameLength enforcement in Smile parser property name decoding, letting attackers exhaust memory by submitting large property names, exploit requires ability to submit data to a parsing endpoint.