High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 29 of 552
- 7.5 /10 HighCVE-2026-103905 No auth
JTL-Shop - Broken Access Control
JTL-Shop administration backend contains a broken access control vulnerability caused by processing the plugin safe mode toggle before authentication, letting unauthenticated remote attackers toggle plugin safe mode causing denial of service, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-103423 No auth
Booking Package WordPress Plugin - Authorization Bypass
Booking Package WordPress plugin <= 1.7.29 contains an authorization bypass caused by improper user authorization verification in booking_package_booked_customers endpoint, letting unauthenticated attackers retrieve PII, exploit requires nonce token exposure via shortcode or widget.
- 7.2 /10 HighCVE-2026-103422 No auth
AnyComment WordPress Plugin - Stored XSS
AnyComment WordPress plugin <= 0.3.6 contains a stored cross-site scripting caused by insufficient input sanitization and missing output escaping in the email parameter on /wp-json/anycomment/v1/subscribe, letting unauthenticated attackers inject scripts executed when admins view subscriptions.
- 8.4 /10 HighCVE-2026-103414 No auth
GUIX - Buffer Overflow
GUIX contains a buffer overflow caused by improper validation of gx_page_header_data_size during binary resource theme loading, letting attackers write past allocated memory, exploit requires crafted resource file.
- 8.1 /10 HighCVE-2026-103367 No auth
ShopMagic WordPress Plugin - Local File Inclusion
ShopMagic – email automation for WordPress plugin for WordPress <= 4.9.0 contains a local file inclusion caused by improper handling of 'billing_address.first_name' parameter, letting unauthenticated attackers execute arbitrary PHP files, exploit requires a published recipe processing {{ customer.first_name }} placeholder.
- 7.5 /10 HighCVE-2026-103366 No auth
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress - Broken Access Control
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress up to 5.7.3 contains an insecure direct object reference caused by lack of ownership checks in booking and cart ID parameters, letting unauthenticated attackers read other users' appointment and cart details via public AJAX routes.
- 7.5 /10 HighCVE-2026-103358 No auth
VillaTheme Email Template Customizer for WooCommerce - Code Injection
VillaTheme Email Template Customizer for WooCommerce <= 1.3.4 contains a code injection vulnerability caused by improper control of code generation, letting attackers inject and execute arbitrary code, exploit requires crafted input.
- 8.6 /10 HighCVE-2026-103307 No auth
Walletdoc Payment Gateway for WooCommerce - SQL Injection & Authentication Bypass
Walletdoc Payment Gateway for WooCommerce WordPress plugin < 1.8.5 contains a SQL injection caused by improper sanitization and empty default signing secret in payment webhook verification, letting unauthenticated attackers perform SQL injection and mark arbitrary orders as paid, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-103081 No auth
VillaTheme Salevo woo-boost-sales - Code Injection
VillaTheme Salevo woo-boost-sales <= 1.3.0 contains a code injection vulnerability caused by improper control of code generation, letting attackers inject and execute arbitrary code, exploit requires crafted input.
- 8.1 /10 HighCVE-2026-102986 Auth required
Plane - Broken Access Control
Plane <= 1.3.1 contains a broken access control vulnerability caused by lack of workspace or project membership verification in EntityAssetEndpoint at /api/public/assets/v2/anchor/{anchor}, letting authenticated users create or soft-delete FileAsset records across workspaces, exploit requires authentication.
- 7.5 /10 HighCVE-2026-102944 No auth
cpp-httplib - Information Disclosure
cpp-httplib < 0.51.0 contains an information disclosure vulnerability caused by improper handling of Cookie headers during cross-origin redirects, letting attackers intercept session cookies, exploit requires attacker control of redirect response or network position on non-HTTPS origin.
- 7.6 /10 HighCVE-2026-102899 No auth
Sentry - Authentication Bypass
Sentry 26.5.0 to 26.7.2 contains an authentication bypass caused by SAML SSO identity-linking flow allowing attacker-controlled SAML IdP to link attacker identity to victim account, letting attackers take control of victim accounts, exploit requires victim to open malicious URL with permissive cookie settings.
- 8.2 /10 HighCVE-2026-102695 No auth
OmniFaces - Broken Access Control
OmniFaces < 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2 contains an information disclosure and denial of service vulnerability caused by acceptance of forged combined resource IDs without server verification in CombinedResourceHandler, letting attackers cause memory exhaustion and disclose Facelets source, exploit requires crafted forged resource ID.
- 8.7 /10 HighCVE-2026-102479 No auth
Eclipse Vert.x - HTTP Request Smuggling
Eclipse Vert.x 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains an HTTP request smuggling vulnerability caused by improper canonicalization of HTTP/1.x headers in io.vertx:vertx-core, letting attackers perform request smuggling via crafted headers.
- 8.6 /10 HighCVE-2026-102460 Auth required
Eclipse Vert.x Web - Broken Access Control
Eclipse Vert.x Web versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contain a broken access control vulnerability caused by ChainAuthHandler skipping scope validation for pre-authenticated users, letting attackers with valid tokens but insufficient scopes bypass scope restrictions, exploit requires pre-authentication by an earlier handler.