High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 256 of 568
- 7.5 /10 HighCVE-2026-95616 No auth
WSS4J - Denial of Service
WSS4J contains an integer overflow caused by improper DER bounds check allowing oversized allocation during X.509 certificate SubjectKeyIdentifier decoding, letting unauthenticated attackers exhaust server memory via crafted SOAP messages.
- 7.5 /10 HighCVE-2026-95587 No auth
Hostinger Migrator - Broken Access Control
Hostinger Migrator <= 1.0 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.
- 8.8 /10 HighCVE-2026-95531 Auth required
Conversational Forms for ChatBot - PHP Object Injection
Conversational Forms for ChatBot <= 1.5.0 contains a PHP object injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-94683 Auth required
DesignSetGo - PHP Object Injection
DesignSetGo <= 2.8.0 contains a PHP object injection caused by unsafe unserialization, letting attackers execute arbitrary code or manipulate application logic, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-94678 Auth required
Go Live Update Urls - PHP Object Injection
Go Live Update Urls <= 7.0.8 contains a PHP Object Injection caused by unsafe deserialization of user input, letting attackers execute arbitrary code remotely, exploit requires crafted input.
- 7.2 /10 HighCVE-2026-94677 Auth required
Kadence WooCommerce Email Designer - PHP Object Injection
Kadence WooCommerce Email Designer <= 1.5.19.1 contains a PHP Object Injection caused by unsafe deserialization, letting attackers inject malicious objects to execute arbitrary code, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-94499 Auth required
FormGent - Broken Access Control
FormGent <= 1.12.2 contains a broken access control vulnerability caused by improper authorization checks, letting attackers access or modify unauthorized resources, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-94178 Auth required
Import and export users and customers - Privilege Escalation
Import and export users and customers <= 2.5.2 contain a privilege escalation vulnerability caused by improper access control, letting attackers escalate their privileges, exploit requires user to be authenticated.
- 8.5 /10 HighCVE-2026-94177 Auth required
GamiPress - SQL Injection
GamiPress <= 8.0.2 contains an SQL injection caused by unsanitized input in database queries, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-94171 No auth
CURCY - Reflected XSS
CURCY <= 2.2.16 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-94123 No auth
NextGEN Gallery - Arbitrary File Download
NextGEN Gallery <= 4.5.0 contains an arbitrary file download vulnerability caused by insufficient access control, letting unauthenticated attackers download arbitrary files remotely, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-94122 Auth required
Responsive Slider Gallery - PHP Object Injection
Responsive Slider Gallery <= 1.5.5 contains a PHP object injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-94121 Auth required
10Web Booster – Website speed optimization, Cache & Page Speed optimizer - PHP Object Injection
10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-94120 No auth
GravityExport Lite for Gravity Forms - Broken Access Control
GravityExport Lite for Gravity Forms <= 2.7.2 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access restricted functionality, exploit requires no authentication.
- 8.5 /10 HighCVE-2026-94115 Auth required
Easy Pricing Tables - SQL Injection
Easy Pricing Tables <= 4.1.2 contains a SQL injection caused by improper sanitization of user input, letting attackers execute arbitrary SQL commands, exploit requires crafted input.