High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 252 of 568
- 7.2 /10 HighCVE-2026-103082 No auth
LA-Studio LA-Studio Element Kit for Elementor - Server Side Request Forgery
LA-Studio LA-Studio Element Kit for Elementor <= 1.6.2 contains a server side request forgery caused by improper validation of URLs, letting attackers make arbitrary requests from the server, exploit requires crafted request.
- 8.8 /10 HighCVE-2026-103068 Auth required
ByteCoreStack MCP Connector for AI Tools - Privilege Escalation
ByteCoreStack MCP Connector for AI Tools <= 1.2.2 contains a privilege escalation vulnerability caused by improper subscriber privilege management, letting attackers escalate their privileges, exploit requires subscriber access.
- 8.0 /10 HighCVE-2026-103067 Auth required
Memberful Memberful - Membership Plugin - Cross Site Request Forgery
Memberful Memberful - Membership Plugin <= 1.81.0 contains a cross site request forgery vulnerability caused by insufficient request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.
- 8.3 /10 HighCVE-2026-102667 No auth
Joyland AI - Stored XSS
Joyland AI app contains a stored XSS caused by JavaScript injection in WebView content, letting attackers with shared network access execute scripts and access sensitive resources, exploit requires network access.
- 8.4 /10 HighCVE-2026-102514 No auth
PeaZip - Remote Code Execution
PeaZip <= 11.2.0 contains an out-of-bounds write caused by improper validation of the first block compressed size in the PEA archive extraction routine, letting attackers execute arbitrary code by opening crafted .pea archives, exploit requires victim to open or extract the archive.
- 7.5 /10 HighCVE-2026-102504 No auth
Perl Imager - Denial of Service
Perl Imager < 1.037 contains a denial of service caused by lack of range checking on raw_datachannels in i_readraw_wiol, letting attackers trigger uncatchable process exit by passing crafted raw_datachannels value, exploit requires attacker to provide untrusted input.
- 8.5 /10 HighCVE-2026-102379 Auth required
VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder - SQL Injection
VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder <= 1.0.28 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-102378 No auth
Parallax Section - Reflected XSS
Parallax Section block <= 2.0.4 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-101888 Auth required
Prime Mover WordPress - Path Traversal
Prime Mover WordPress plugin < 2.2.1 contains a path traversal caused by improper ZIP entry name validation in migration ZIP import, letting authenticated administrators write arbitrary files outside intended directories, potentially leading to remote code execution.
- 8.8 /10 HighCVE-2026-101147 No auth
Featured Image from URL (FIFU) WordPress Plugin - Cross-Site Request Forgery
Featured Image from URL (FIFU) WordPress plugin < 6.0.8 and FIFU Premium < 8.2.8 contain a cross-site request forgery caused by improper REST API nonce enforcement, letting attackers make logged-in administrators perform any REST API action via crafted URLs.
- 7.5 /10 HighCVE-2026-100517 No auth
WooCommerce Photo Reviews - Broken Access Control
WooCommerce Photo Reviews <= 1.2.30 contains an insecure direct object reference caused by lack of proper access control, letting unauthenticated attackers access or modify unauthorized data.
- 7.5 /10 HighCVE-2026-100514 No auth
Log REST API - Broken Access Control
Log REST API <= 1.7.2 contains an insecure direct object reference caused by lack of proper access control, letting unauthenticated attackers access or modify unauthorized data.
- 7.5 /10 HighCVE-2024-58388 CISA KEVNo auth
Sharp & Toshiba Tec Multifunction Printers - Local File Inclusion
Sharp and Toshiba Tec multifunction printers contain an unauthenticated local file inclusion caused by manipulation of the path parameter in installed_emanual_down.html, letting remote attackers read arbitrary files via directory traversal.
- 7.5 /10 HighCVE-2023-54404 No auth
Zod - Uncontrolled Resource Consumption
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability caused by unbounded array validation in $ZodArray, letting attackers exhaust memory by submitting large arrays, exploit requires no length constraint on array schema.
- 7.2 /10 HighCVE-2026-97347 PoC publicNo auth
Post Views Stats Counter WordPress - Stored XSS
Post Views Stats Counter WordPress plugin <= 1.1.7 contains a stored cross-site scripting caused by insufficient sanitization and escaping of User-Agent header, letting unauthenticated attackers inject scripts executed on page access.