High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 269 of 568

  • 7.2 /10 High
    CVE-2026-102392 Auth required

    Shop Manager - PHP Object Injection

    Shop Manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 contains a PHP Object Injection caused by unsafe unserialize usage, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-102391 No auth

    JetFormBuilder - Reflected XSS

    JetFormBuilder <= 3.6.5.4 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-102385 No auth

    Ninja Forms - Reflected XSS

    Ninja Forms <= 3.15.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-102377 Auth required

    Photo Gallery by 10Web - PHP Object Injection

    Photo Gallery by 10Web <= 1.8.46 contains a PHP Object Injection caused by unsafe deserialization, letting attackers inject malicious objects to execute arbitrary code, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-102376 No auth

    Branda - Stored XSS

    Branda <= 3.4.32 contains a stored XSS caused by improper input sanitization, letting remote attackers execute arbitrary scripts, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-102150 No auth

    Kiteworks Advanced Forms - Authentication Bypass

    Kiteworks Advanced Forms contains an authentication bypass caused by a function reachable without authentication, letting unauthenticated attackers perform limited internal service operations, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-102143 No auth

    Appliance - Unrestricted File Upload

    An appliance contains an unrestricted file upload caused by an administrative upload handler lacking proper authentication, letting unauthenticated attackers write files to the filesystem, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-102142 Auth required

    Kiteworks - Command Injection

    Kiteworks appliance contains a command injection caused by evaluation of expressions in stored system notification templates, letting authenticated System Administrators execute operating-system commands, exploit requires admin authentication.

  • 7.2 /10 High
    CVE-2026-102132 Auth required

    Kiteworks Core - Broken Access Control

    Kiteworks Core contains a broken access control vulnerability caused by insufficient verification of administrator entitlement during privileged integration credential import, letting delegated administrators escalate to full system administrator privileges, exploit requires delegated admin access.

  • 7.2 /10 High
    CVE-2026-102131 Auth required

    Kiteworks Email Protection Gateway - Command Injection

    Kiteworks Email Protection Gateway contains a command injection caused by improper validation of configuration settings, letting authenticated administrators execute arbitrary code as the gateway service account, exploit requires administrator authentication.

  • 7.2 /10 High
    CVE-2026-102130 Auth required

    Kiteworks Email Protection Gateway - Command Injection

    Kiteworks Email Protection Gateway contains a command injection caused by insufficient validation of uploaded backup content, letting authenticated administrators execute arbitrary code as the service account.

  • 7.2 /10 High
    CVE-2026-102129 Auth required

    Kiteworks Core - Broken Access Control

    Kiteworks Core contains a broken access control vulnerability caused by insufficient verification of administrator entitlement in user-provisioning interface, letting delegated administrators escalate privileges to full system-administrator.

  • 7.5 /10 High
    CVE-2026-102128 No auth

    Kiteworks Email Protection Gateway - Authentication Bypass

    Kiteworks Email Protection Gateway contains an identity verification weakness caused by improper authentication checks, letting remote unauthenticated attackers act on behalf of users and provision platform accounts, exploit requires no authentication.

  • 7.0 /10 High
    CVE-2026-102127 No auth

    Kiteworks Email Protection Gateway - XML External Entity Injection

    Kiteworks Email Protection Gateway contains an XML external entity injection caused by unrestricted external entity references in an optional message-processing feature, letting remote unauthenticated attackers read files accessible to the gateway service account.

  • 8.1 /10 High
    CVE-2026-102126 Auth required

    Kiteworks Core - Stored XSS

    Kiteworks Core contains a stored XSS caused by insufficient input sanitization allowing a delegated administrator to store crafted content that executes arbitrary JavaScript in a System Administrator's session, exploit requires delegated admin privileges.