High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 26 of 725
- 7.2 /10 HighCVE-2026-116622 No auth
The Food Store – Online Food Delivery & Pickup - Stored XSS
The Food Store – Online Food Delivery & Pickup WordPress plugin <= 1.5.5 contains a stored cross-site scripting caused by insufficient sanitization of the 'service_time' parameter, letting unauthenticated attackers inject scripts, exploit requires specific plugin options configuration.
- 7.1 /10 HighCVE-2026-116405 No auth
VikRentCar - Reflected XSS
VikRentCar <= 1.4.9 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-116401 No auth
HUSKY - Broken Access Control
HUSKY <= 1.4.6 contains a broken access control vulnerability caused by improper authorization checks, letting unauthenticated attackers access restricted resources, exploit requires no authentication.
- 8.4 /10 HighCVE-2026-116249 Auth required
pgAdmin 4 - Path Traversal & Injection
pgAdmin 4 < 9.19 contains a path traversal and parameter injection vulnerability caused by improper path resolution and insufficient connection parameter validation, letting attackers access or manipulate other users' files and inject connection parameters, exploit requires crafted server configuration input.
- 8.2 /10 HighCVE-2026-116247 Auth required
pgAdmin 4 - Authentication Bypass
pgAdmin 4 < 9.19 contains a broken authentication caused by missing or inaccessible password and client certificate files in server mode, letting any user connect using the service account's credentials, exploit requires server mode without configured credentials.
- 8.2 /10 HighCVE-2026-116245 Auth required
pgAdmin 4 - Authentication Bypass
pgAdmin 4 < 9.19 contains a broken authentication caused by unrestricted use of service connection parameters in server mode, letting any user connect with credentials from service files, exploit requires server mode operation with default settings.
- 8.2 /10 HighCVE-2026-116244 PoC public
pgAdmin 4 - Authentication Bypass
pgAdmin 4 < 9.19 contains a broken authentication caused by improper handling of Kerberos delegated credentials in connection environment, letting attackers connect as the service account's Kerberos principal, exploit requires server mode or Windows SSPI usage.
- 7.5 /10 HighCVE-2026-116243 Auth required
pgAdmin 4 - Command Injection
pgAdmin 4 < 9.19 contains a command injection caused by improper validation of user-set binary paths allowing execution of arbitrary binaries from shared storage, letting authenticated users execute OS commands, exploit requires user to set binary path to malicious executable.
- 8.2 /10 HighCVE-2026-116242 Auth required
pgAdmin 4 - Authentication Bypass
pgAdmin 4 < 9.19 contains an authentication bypass caused by SSH tunnel configuration in server mode using the service account's SSH keys and agent, letting any user create tunnels without their own credentials, exploit requires server mode usage.
- 8.5 /10 HighCVE-2026-116239 Auth required
pgAdmin 4 - Authentication Bypass
pgAdmin 4 < 9.19 contains an authentication bypass caused by improper account source verification after LDAP or Kerberos authentication, letting attackers log in as another account with matching username, exploit requires valid LDAP or Kerberos credentials.
- 8.1 /10 HighCVE-2026-116238 No auth
pgAdmin 4 - Authentication Bypass
pgAdmin 4 < 9.19 contains an authentication bypass caused by improper handling of internal account lockout and password verification in Flask-Security views, letting unauthenticated attackers perform unlimited password guesses on internal accounts, exploit requires server mode with default configuration.
- 8.7 /10 HighCVE-2026-115830
Secret Server - Authentication Bypass
Secret Server < 12.3.1 contains a broken authentication caused by acceptance of unsigned JWT tokens, letting attackers gain cloudadmin permissions, exploit requires specific conditions to submit unsigned JWT.
- 8.7 /10 HighCVE-2026-115829 Auth required
Secret Server - Authentication Bypass
Secret Server < 12.3.1 contains an authentication bypass caused by improper multi-factor authentication logic, letting attackers bypass initial login by completing only the second factor, exploit requires multi-factor authentication enabled.
- 8.3 /10 HighCVE-2026-115642 Auth required
OpenStack keystonemiddleware - Broken Access Control
OpenStack keystonemiddleware < 13.0.2 contains a broken access control vulnerability caused by improper validation of custom X-Service-Token header, letting attackers with application credentials bypass restrictions and escalate privileges.
- 8.1 /10 HighCVE-2026-115346 No auth
Avada Website Builder For WordPress & WooCommerce - Unrestricted File Upload
Avada Website Builder For WordPress & WooCommerce theme for WordPress <= 7.16.2 contains an unrestricted file upload vulnerability caused by insufficient file type validation in convert_palette_images_to_truecolor() function, letting unauthenticated attackers upload executable files and achieve remote code execution.