High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 28 of 725
- 7.2 /10 HighCVE-2026-104744 No auth
Independent Analytics Pro WordPress Plugin - Stored XSS
Independent Analytics Pro WordPress plugin <= 2.15.5 contains a stored XSS caused by insufficient sanitization and escaping of 'utm_campaign' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires plugin active and attacker to obtain a server-signed payload.
- 7.9 /10 HighCVE-2026-104615 Auth required
SUSE Rancher Fleet - Broken Access Control
SUSE Rancher Fleet < 0.12, 0.13.0 to 0.13.17, 0.14.0 to 0.14.12, 0.15.0 to 0.15.17, and 0.16.0 to 0.16.3 contains a broken access control caused by accepting cluster identity without binding to the registration token, letting attackers associate registration requests with clusters registered with different tokens, exploit requires crafted registration request.
- 8.8 /10 HighCVE-2026-104368 Auth required
WordPress Export and Import Users and Customers - Privilege Escalation
WordPress Export and Import Users and Customers plugin <= 2.7.5 contains a privilege escalation caused by CSV escape-character mismatch between export and import components, letting authenticated subscribers create arbitrary administrator accounts, exploit requires subscriber-level access.
- 7.8 /10 HighCVE-2026-104067 No auth
Scribus - Out of Bounds Read/Write
Scribus < 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin caused by failure to verify bitmap and transparency mask dimensions, letting attackers trigger heap reads/writes and potential code execution as the user, exploit requires crafted SVM file.
- 7.8 /10 HighCVE-2026-104066 No auth
Scribus - Buffer Overflow
Scribus < 1.6.7 contains a heap buffer overflow caused by improper unpacking of 4-bit indexed pixel data in the Mac PICT image loader and import plugin, letting attackers execute code or cause crashes via crafted PICT files, exploit requires user to place or import crafted files.
- 7.8 /10 HighCVE-2026-104065 No auth
Scribus - Buffer Overflow
Scribus < 1.6.7 contains a buffer overflow caused by unvalidated y offset in importdrw Micrografx Draw plugin, letting attackers execute code or cause crashes by importing crafted DRW files, exploit requires user to import malicious file.
- 7.8 /10 HighCVE-2026-104064 No auth
Scribus - Integer Overflow
Scribus < 1.6.7 contains an integer overflow caused by improper handling of tile dimensions in the scimgdataloader_tiff TIFF loader, letting attackers trigger heap overflow to crash or execute code, exploit requires user to import crafted TIFF.
- 7.8 /10 HighCVE-2026-104062 No auth
Scribus - Buffer Overflow
Scribus < 1.6.7 contains a heap buffer overflow caused by unchecked bytesPerLine value in the PICT image loader and import plugin, letting attackers execute code as the user by crafting malicious PICT files.
- 7.8 /10 HighCVE-2026-104061 No auth
Scribus - Out of Bounds Read/Write
Scribus < 1.6.7 contains a heap out-of-bounds write caused by unchecked PSD file values in scimgdataloader_psd loader, letting attackers cause crashes or execute code by convincing users to import crafted PSD files.
- 7.5 /10 HighCVE-2026-103963
glib-networking - Denial of Service
glib-networking contains a denial of service caused by unbounded client-side TLS 1.3 session ticket caching, letting malicious servers exhaust client memory, exploit requires connection to a malicious server.
- 7.2 /10 HighCVE-2026-101214 Auth required
Dell OpenManage Enterprise - OS Command Injection
Dell OpenManage Enterprise < 4.8.0 contains an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands, exploit requires high privileges.
- 7.8 /10 HighCVE-2026-101213 Auth required
Dell OpenManage Enterprise - Privilege Escalation
Dell OpenManage Enterprise < 4.8.0 contains an improper privilege management vulnerability, letting low privileged local attackers escalate their privileges, exploit requires local access with low privileges.
- 7.2 /10 HighCVE-2026-101210 Auth required
Dell OpenManage Enterprise - Command Injection
Dell OpenManage Enterprise < 4.8.0 contains an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands, exploit requires high privileges.
- 8.7 /10 HighCVE-2025-8574 Auth required
Database Cleaner WordPress plugin - Broken Access Control
Database Cleaner WordPress plugin <= 1.4.7 contains a broken access control vulnerability caused by lack of restriction on deletable database tables, letting authenticated administrators delete core WordPress tables.
- 8.4 /10 HighCVE-2025-68394 Auth required
ARKETEAM Protectel - SQL Injection
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a sql injection caused by improper neutralization of input in the "profilInput" parameter, letting low privileged users execute arbitrary SQL commands.