High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 27 of 725
- 7.5 /10 HighCVE-2026-114443 Auth required
Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress - Authentication Bypass
Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin < 2.191 contains a broken authentication caused by lack of password verification before accepting two-factor authenticator codes, letting attackers with valid authenticator codes log in as any user including administrators without passwords, exploit requires possession of valid authenticator code.
- 7.5 /10 HighCVE-2026-114422 No auth
Enable Media Replace WordPress - Insecure Deserialization
Enable Media Replace WordPress plugin < 4.2.3 contains a PHP Object Injection caused by unrestricted classes during deserialization in media replace-and-update-links routine, letting unauthenticated attackers escalate to remote code execution if attacker-controlled PHP/HTML files exist, exploit requires user with upload access to perform media replacement.
- 7.2 /10 HighCVE-2026-112365 No auth
easy.jobs WordPress Plugin - Stored XSS
easy.jobs WordPress plugin <= 2.8.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'cover_letter' parameter, letting unauthenticated attackers inject scripts executed when an admin views the candidate's Application tab, exploit requires admin interaction with crafted link.
- 7.6 /10 HighCVE-2026-112347 Auth required
Kirki WordPress Plugin - Broken Access Control
Kirki plugin for WordPress before 6.4.1 contains a broken access control vulnerability caused by insufficient per-object capability checks in the page REST API, letting users with Kirki edit access modify any non-trashed post including private or draft content, exploit requires user to have Kirki edit access.
- 7.5 /10 HighCVE-2026-111578 No auth
WooCommerce PDF Invoices & Packing Slips - Stored Cross-Site Scripting
WooCommerce PDF Invoices & Packing Slips plugin > 5.16.2 and < 5.16.5 contains a stored cross-site scripting caused by improper escaping of customer-supplied order fields in invoice and packing-slip documents, letting unauthenticated guest users store malicious scripts executed by shop administrators, exploit requires placing guest orders.
- 8.8 /10 HighCVE-2026-111505 Auth required
Dell OpenManage Enterprise - Command Injection
Dell OpenManage Enterprise < 4.8.0 contains an OS command injection caused by improper neutralization of special elements, letting low privileged remote attackers execute arbitrary commands, exploit requires remote access.
- 7.2 /10 HighCVE-2026-111504 Auth required
Dell OpenManage Enterprise - Command Injection
Dell OpenManage Enterprise < 4.8.0 contains an argument injection caused by improper neutralization of argument delimiters, letting high privileged remote attackers escalate privileges, exploit requires high privilege remote access.
- 7.1 /10 HighCVE-2026-111503 Auth required
Dell OpenManage Enterprise - SQL Injection
Dell OpenManage Enterprise < 4.8.0 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low privileged remote attackers expose sensitive information, exploit requires low privileged remote access.
- 8.6 /10 HighCVE-2026-110972
Płatnik - Authentication Bypass
Płatnik 10.02.002 contains an authentication bypass caused by client-side authentication, letting attackers with access to any application instance authenticate as arbitrary users, exploit requires attacker access to application instance.
- 7.7 /10 HighCVE-2026-110971
Płatnik - Weak Cryptography
Płatnik software contains weak password encoding allowing users who obtain encoded passwords to easily decode them, letting attackers recover passwords, exploit requires access to encoded passwords.
- 7.5 /10 HighCVE-2026-110732 No auth
AI Engine – The Chatbot, AI Framework & MCP for WordPress - Broken Access Control
AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin <= 3.8.6 contains a missing authorization vulnerability caused by an OAuth 2.1 Dynamic Client Registration endpoint with __return_true permission_callback, letting unauthenticated attackers register OAuth clients and gain admin-level control after consent, exploit requires administrator approval and clickjacking.
- 7.5 /10 HighCVE-2026-110305 No auth
Advanced Custom Fields: Extended - Sensitive Information Exposure
Advanced Custom Fields: Extended plugin for WordPress <= 0.9.2.7 contains a sensitive information exposure caused by injection of {get_user} template tag in process component, letting unauthenticated attackers extract sensitive data including WordPress password hashes, exploit requires administrator configuration of public [acfe_form] shortcode page with Term action using save.name field mapping.
- 7.5 /10 HighCVE-2026-107630 No auth
Email Templates Customizer and Designer for WordPress and WooCommerce - Authorization Bypass
Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers enumerate order IDs and exfiltrate customer PII, exploit requires two unauthenticated requests with nonce harvesting.
- 8.8 /10 HighCVE-2026-105894 Auth required
Ak Framework WordPress Plugin - Privilege Escalation
Ak Framework plugin for WordPress <= 2.9.8 contains a privilege escalation caused by missing capability checks in ajax_refresh_nonce and ak_admin_ajax handlers, letting unauthenticated attackers update arbitrary options to escalate privileges.
- 7.1 /10 HighCVE-2026-105077 No auth
Ad Inserter - Reflected XSS
Ad Inserter <= 2.8.19 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.