High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 259 of 568
- 7.5 /10 HighCVE-2026-86128 No auth
Fireware OS - Denial of Service
Fireware OS contains a null pointer dereference vulnerability in the NetFlow packet-processing feature, letting remote unauthenticated attackers cause denial of service by sending specially crafted IPv6 packets.
- 7.1 /10 HighCVE-2026-86105 Auth required
Fireware OS Access Portal - Broken Access Control
Fireware OS Access Portal contains an improper authorization vulnerability caused by insufficient access control in the reverse proxy, letting authenticated low-privileged users access unauthorized web applications, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-86104 No auth
Fireware OS - Denial of Service
Fireware OS contains a denial of service vulnerability caused by uncontrolled resource consumption in the login process (wgagent), letting remote unauthenticated attackers cause service disruption, exploit requires crafted request.
- 8.8 /10 HighCVE-2026-85573 No auth
All in One Files Upload WordPress plugin - Stored XSS
All in One Files Upload WordPress plugin < 2.0.17 contains a stored XSS caused by unsanitized SVG file uploads and lack of upload request verification, letting unauthenticated attackers store active content executed in site's origin, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-85532 No auth
Apache WSS4J - Weak Cryptography & Denial of Service
Apache WSS4J contains a cryptographic weakness caused by accepting attacker-controlled derived-key lengths and offsets without adequate bounds, letting attackers cause weak keys or resource exhaustion, exploit requires crafted WS-Security messages.
- 8.1 /10 HighCVE-2026-79625 Auth required
Affected products - Race Condition
Affected products contain a race condition caused by improper synchronization in monitoring functionality, letting authenticated remote attackers cause incorrect data processing or denial of service, exploit requires monitoring access.
- 7.5 /10 HighCVE-2026-76992
CODESYS Gateway Client - Denial of Service
CODESYS Gateway Client contains a denial of service caused by unchecked memory allocation based on size field in gateway response, letting unauthenticated remote attackers cause excessive memory consumption, exploit requires attacker to control a malicious gateway.
- 7.4 /10 HighCVE-2026-75823
User Frontend WordPress plugin - Broken Access Control
User Frontend WordPress plugin < 4.3.12 contains a broken access control vulnerability caused by insufficient validation of role assignment in the registration form, letting unauthenticated users register with elevated roles like Editor, exploit requires PHP sodium extension to be unavailable and a configured registration page.
- 7.5 /10 HighCVE-2026-75098 No auth
WordPress Product Designer App - Path Traversal
Product Designer App plugin for WordPress <= 1.1.3 contains a directory traversal caused by improper validation of the 'svg' parameter, letting unauthenticated attackers read arbitrary files, exploit requires publicly exposed nonce and token.
- 7.5 /10 HighCVE-2026-6806 No auth
The Motors – Car Dealership & Classified Listings Plugin - SQL Injection
The Motors – Car Dealership & Classified Listings Plugin for WordPress <= 1.4.109 contains a time-based blind SQL injection caused by insufficient escaping of 'stm_lat/stm_lng' parameters, letting unauthenticated attackers extract sensitive database information, exploit requires crafted parameter input.
- 7.8 /10 HighCVE-2026-62146 PoC public
CRI-O - Broken Access Control
CRI-O contains a trust-boundary flaw in sandbox state persistence caused by attacker-influenced pod metadata overwriting reserved sandbox bookkeeping, letting attackers escape container via host runtime resource exposure after restart, exploit requires attacker to influence pod metadata.
- 7.6 /10 HighCVE-2026-62097 Auth required
WPTasty Business Directory - SQL Injection
WPTasty Business Directory business-directory-plugin <= 6.4.27 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.
- 7.6 /10 HighCVE-2026-62085 Auth required
WP Activity Log - SQL Injection
WP Activity Log <= 5.6.6 contains a SQL injection caused by improper sanitization of input, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
- HighCVE-2026-55224 No auth
MineAdmin - Path Traversal to Remote Code Execution
MineAdmin before 3.2.0-alpha.2 contains a path traversal vulnerability in the app-store plugin service where the identifier parameter is unsanitized in filesystem paths, allowing attackers to execute arbitrary code.
- 7.8 /10 HighCVE-2026-53605 Auth required
Reachy Mini ISO for Wireless - Privilege Escalation
Reachy Mini ISO for Wireless < 0.2.4 contains a local privilege escalation caused by an overly broad sudoers entry granting pollen daemon user passwordless sudo access to /usr/bin/systemctl without restrictions, letting local attackers escalate to root, exploit requires local pollen user privileges.