High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 29 of 725

  • 8.4 /10 High
    CVE-2025-68393 Auth required

    ARKETEAM Protectel - SQL Injection

    ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a SQL injection caused by improper neutralization of input in the "Utilisateur" parameter, letting low privileged users execute arbitrary SQL commands.

  • 7.5 /10 High
    CVE-2010-20125 CISA KEVNo auth

    DedeCMS - File Inclusion

    DedeCMS < 5.7 contains a file inclusion vulnerability caused by uninitialized 'code' parameter in plus/carbuyaction.php, letting remote unauthenticated attackers include arbitrary local files via path traversal.

  • 7.2 /10 High
    CVE-2026-96767 No auth

    NEX-Forms – Ultimate Forms Plugin for WordPress - Stored XSS

    NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.2 contains a stored XSS caused by insufficient input sanitization and output escaping in the 'type' parameter, letting unauthenticated attackers inject scripts executed on user page access.

  • 7.2 /10 High
    CVE-2026-96741 No auth

    DSGVO All in one for WP - Stored XSS

    DSGVO All in one for WP plugin for WordPress <= 5.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers inject scripts executed on user page access, exploit requires admin approval of crafted comment with specific plugin options enabled.

  • 7.2 /10 High
    CVE-2026-96669 No auth

    The Food Store – Online Food Delivery & Pickup - Stored XSS

    The Food Store – Online Food Delivery & Pickup WordPress plugin <= 1.5.5 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'service_type' cookie, letting unauthenticated attackers inject scripts executed in admin panel, exploit requires injecting payload via public checkout page.

  • 7.2 /10 High
    CVE-2026-96666 No auth

    Schema App Structured Data WordPress Plugin - Stored XSS

    Schema App Structured Data WordPress plugin <= 2.3.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'Remove Microdata' output filter, letting unauthenticated attackers inject scripts executed by users, exploit requires admin to enable 'Remove Microdata' and approve malicious comment.

  • 8.1 /10 High
    CVE-2026-96228 No auth

    SSL Wireless SMS Notification for WordPress - Authentication Bypass

    SSL Wireless SMS Notification for WordPress <= 3.8.1 contains an authentication bypass caused by improper verification of SMS OTP and server-side state in final_login_ajax_action, letting unauthenticated attackers take over accounts by knowing phone numbers.

  • 8.8 /10 High
    CVE-2026-96203 No auth

    Microsoft Edge - Privilege Escalation

    Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows unauthorized attackers to elevate privileges over a network, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-96199 No auth

    Microsoft Edge - Remote Code Execution

    Microsoft Edge (Chromium-based) contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-96198 No auth

    Microsoft Edge - Remote Code Execution

    Microsoft Edge (Chromium-based) contains a heap-based buffer overflow allowing unauthorized attackers to execute code remotely over a network, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-96196 No auth

    Microsoft Edge - Security Feature Bypass

    Microsoft Edge (Chromium-based) contains a security feature bypass caused by an incomplete list of disallowed inputs, letting unauthorized attackers bypass security over a network, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-96192 No auth

    Microsoft Edge - Use After Free

    Microsoft Edge for iOS contains a use after free vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 7.4 /10 High
    CVE-2026-96187 No auth

    Microsoft Edge - Information Disclosure

    Microsoft Edge (Chromium-based) contains a type confusion vulnerability caused by access of resource using incompatible type, letting unauthorized attackers disclose information over a network, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-9536 No auth

    vtk - Buffer Overflow

    vtk 9.6.1 contains a heap-based buffer overflow caused by improper handling in FindVariableOffsets functionality, letting attackers trigger buffer overflow via a malicious .wind file, exploit requires attacker to provide crafted file.

  • 8.2 /10 High
    CVE-2026-9535 No auth

    vtk - Out-of-Bounds Read

    vtk 9.6.1 contains an out-of-bounds read caused by improper handling of specially crafted chaco files in vtkChacoReader InputGraph2, letting attackers read memory out-of-bounds, exploit requires malicious file input.