High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 258 of 568
- 7.5 /10 HighCVE-2026-92871 No auth
Pgpool-II - Denial of Service
Pgpool-II contains a null pointer dereference vulnerability that allows unauthenticated attackers to cause abnormal termination of the watchdog process, leading to denial of service.
- 7.5 /10 HighCVE-2026-92870 No auth
Pgpool-II - Buffer Overflow
Pgpool-II contains a stack-based buffer overflow vulnerability that may allow an unauthenticated attacker to cause abnormal process termination, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-92867 Auth required
Pgpool-II - Out of Bounds Write
Pgpool-II contains an out-of-bounds write vulnerability that allows authenticated attackers to cause abnormal process termination or execute arbitrary code.
- 8.8 /10 HighCVE-2026-92172 Auth required
Meta Horizon OS - Privilege Escalation
Meta Horizon OS < 66.0.0.733.524 contains a privilege escalation caused by OVRMediaService sending privileged PendingIntent with com.oculus.horizon CallerIdentity to arbitrary apps via broadcast receiver, letting attackers impersonate com.oculus.horizon package, exploit requires app registering for com.oculus.systemactivities.SCREENSHOT.
- 7.5 /10 HighCVE-2026-92121 No auth
Apache WSS4J - Broken Access Control
Apache WSS4J streaming (StAX) code contains a broken access control vulnerability caused by a permanently set internal flag in WS-Security STR-Transform, letting attackers bypass SOAP Body signature verification, exploit requires crafted SOAP messages.
- 7.1 /10 HighCVE-2026-91832 No auth
WP Mobile Menu - Stored XSS
WP Mobile Menu WordPress plugin < 2.9 contains a stored cross-site scripting caused by improper nonce verification on settings import, letting attackers import arbitrary settings and execute scripts in administrator sessions, exploit requires administrator session.
- 8.1 /10 HighCVE-2026-90441 Auth required
wgagent - Broken Access Control
wgagent management daemon contains a missing authorization vulnerability in session initialization, letting authenticated low-privileged users crash the process and read arbitrary files, exploit requires authenticated low-privileged user.
- 7.5 /10 HighCVE-2026-89294 Auth required
Simply Schedule Appointments - Local File Inclusion
Simply Schedule Appointments WordPress plugin <= 1.6.12.27 contains a local file inclusion caused by unsanitized 'ssa_locale' parameter, letting unauthenticated attackers execute arbitrary PHP code, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-89193 No auth
Robin Image Optimizer - Stored XSS
Robin Image Optimizer WordPress plugin < 2.0.8 contains a stored XSS caused by unescaped values in HTML parser element attributes when non-default image delivery mode is enabled, letting unauthenticated attackers execute scripts in users' browsers.
- 7.1 /10 HighCVE-2026-88797 Auth required
Vayu X WordPress theme - Broken Access Control
Vayu X WordPress theme < 1.0.6 contains a broken access control vulnerability caused by missing capability checks on an AJAX action, letting authenticated users install and activate plugins, exploit requires user to be logged in.
- 8.1 /10 HighCVE-2026-87004 PoC publicNo auth
Tugtainer - Authentication Bypass
Tugtainer < 1.31.3 contains an authentication bypass caused by improper OIDC id_token validation in auth_oidc_provider.py, letting attackers bypass token verification and impersonate users, exploit requires valid OIDC login flow completion.
- 8.1 /10 HighCVE-2026-86136 Auth required
wgagent - Broken Access Control
wgagent management daemon contains a missing authorization vulnerability in session initialization, letting authenticated low-privileged users crash the process and read arbitrary files via crafted management API requests.
- 7.5 /10 HighCVE-2026-86134 No auth
WatchGuard Fireware OS - Denial of Service
WatchGuard Fireware OS contains a null pointer dereference caused by improper handling in the authentication process, letting remote unauthenticated attackers crash the management daemon, exploit requires sending a specially crafted request to the login interface.
- 7.5 /10 HighCVE-2026-86133 No auth
WatchGuard Fireware OS - Denial of Service
WatchGuard Fireware OS IKE daemon contains an integer underflow vulnerability caused by processing specially crafted encrypted IKEv2 messages, letting remote attackers crash the iked process after completing initial IKEv2 handshake, exploit requires completed initial handshake.
- 7.5 /10 HighCVE-2026-86132 No auth
WatchGuard Fireware OS - Denial of Service
WatchGuard Fireware OS contains an integer underflow vulnerability in the IKEv2 daemon (iked) caused by processing specially crafted encrypted IKEv2 messages with AES-GCM cipher suite, letting remote unauthenticated attackers crash the process.