High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 254 of 568

  • 7.1 /10 High
    CVE-2026-97235 No auth

    ThemeREX Addons - Reflected XSS

    ThemeREX Addons < 2.45.0 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-97197 No auth

    WordPress Backup & Migration - Broken Access Control

    WordPress Backup & Migration <= 1.6.0 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 7.2 /10 High
    CVE-2026-97150 Auth required

    baserCMS BcAddonMigrator - File Inclusion

    baserCMS BcAddonMigrator contains an arbitrary file read and deletion vulnerability caused by inclusion and execution of addon config.php files, letting administrative users read or delete arbitrary files, exploit requires administrative privileges.

  • 7.1 /10 High
    CVE-2026-97077 No auth

    Ad Inserter - Reflected XSS

    Ad Inserter <= 2.8.18 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-97065 No auth

    Happyforms - Reflected XSS

    Happyforms <= 1.26.15 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-96838 No auth

    Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification - Cross Site Request Forgery

    Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 contains an unauthenticated cross site request forgery caused by lack of proper request validation, letting unauthenticated attackers perform unauthorized actions, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-96837 Auth required

    CartFlows - Remote Code Execution

    CartFlows <= 3.2.0 contains a remote code execution caused by improper input handling, letting remote attackers execute arbitrary code, exploit requires crafted request.

  • 7.1 /10 High
    CVE-2026-96836 No auth

    Parsi Date - Stored XSS

    Parsi Date <= 6.3 contains an unauthenticated stored cross site scripting caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-96833 Auth required

    Ultimate Addons for Contact Form 7 - PHP Object Injection

    Ultimate Addons for Contact Form 7 <= 3.5.51 contains a PHP object injection caused by unsafe deserialization in the Editor component, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-96832 Auth required

    Content Egg - PHP Object Injection

    Shop manager PHP Object Injection in Content Egg <= 6.3.1 contains a PHP object injection vulnerability caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-96831 Auth required

    Themify Builder - PHP Object Injection

    Themify Builder <= 7.8.1 contains a PHP Object Injection caused by unsafe unserialize usage, letting attackers inject arbitrary objects, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-96830 No auth

    GiveWP - Reflected XSS

    GiveWP <= 4.16.9 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no special privileges.

  • 7.6 /10 High
    CVE-2026-96828 Auth required

    Category Discount WooCommerce - SQL Injection

    Category Discount WooCommerce <= 5.18 contains an SQL injection caused by improper sanitization of administrator inputs, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.

  • 7.6 /10 High
    CVE-2026-96827 Auth required

    Admin Notices Manager - SQL Injection

    Admin Notices Manager <= 1.6.0 contains a SQL injection caused by improper sanitization of administrator inputs, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.

  • 7.5 /10 High
    CVE-2026-96823 No auth

    WooCommerce - Broken Access Control

    WooCommerce <= 5.120.0 contains an unauthenticated arbitrary content deletion vulnerability in customer reviews, letting unauthenticated attackers delete review content remotely, exploit requires no authentication.