High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 297 of 628

  • 7.2 /10 High
    CVE-2026-95670 No auth

    No External Links WordPress plugin - Stored XSS

    No External Links WordPress plugin <= 5.2.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in /goto/{base64} redirect, letting unauthenticated attackers execute arbitrary scripts, exploit requires 'Link Encoding: Base64' option enabled.

  • 8.2 /10 High
    CVE-2026-94653 No auth

    Apache Thrift - Denial of Service

    Apache Thrift PHP bindings before 0.25.0 contain an inefficient algorithmic complexity vulnerability caused by suboptimal algorithm implementation, letting attackers cause denial of service via resource exhaustion, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-94651 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains a resource management vulnerability caused by improper handling of exceptional conditions in Java bindings, letting attackers cause resource exhaustion, exploit requires no special privileges.

  • 8.2 /10 High
    CVE-2026-94648 No auth

    Apache Thrift - Denial of Service

    Apache Thrift < 0.25.0 contains an allocation of resources without limits or throttling vulnerability in dart bindings, letting attackers cause denial of service by exhausting resources, exploit requires no special privileges.

  • 8.2 /10 High
    CVE-2026-94645 No auth

    Apache Thrift - Denial of Service

    Apache Thrift < 0.25.0 contains an allocation of resources without limits or throttling vulnerability caused by improper validation of specified quantity in Node.js bindings, letting attackers cause resource exhaustion, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-94644 No auth

    Apache Thrift - Denial of Service

    Apache Thrift PHP bindings before 0.25.0 contain an allocation of resources without limits or throttling vulnerability, letting attackers cause denial of service by exhausting resources, exploit requires no special privileges.

  • 8.7 /10 High
    CVE-2026-94642 No auth

    Apache Thrift - Uncaught Exception

    Apache Thrift < 0.25.0 contains an uncaught exception vulnerability in PHP bindings, letting attackers cause unexpected application behavior, exploit requires crafted input triggering the exception.

  • 8.2 /10 High
    CVE-2026-94639 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains an uncaught exception vulnerability caused by improper handling of exceptional conditions and resource allocation without limits in Java bindings, letting attackers cause denial of service, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-94637 No auth

    Apache Thrift - Denial of Service

    Apache Thrift Go bindings before 0.25.0 contain an improper handling of highly compressed data vulnerability caused by data amplification, letting attackers potentially cause denial of service, exploit requires crafted compressed data.

  • 7.8 /10 High
    CVE-2026-94593

    Armatura One - Information Disclosure

    Armatura One contains an information disclosure caused by logging the full database connection command including superuser password in plain text, letting attackers with OS access retrieve credentials, exploit requires OS access.

  • 8.4 /10 High
    CVE-2026-94592

    Armatura One - Authentication Bypass

    Armatura One contains a broken authentication caused by use of a fixed vendor-defined password for the database superuser account, letting attackers with OS access authenticate as superuser, exploit requires OS access and knowledge of the password.

  • 8.4 /10 High
    CVE-2026-94591

    Armatura One - Information Disclosure

    Armatura One contains a cryptographic weakness caused by fixed AES-128-CBC encryption key and IV embedded in the software, letting attackers decrypt stored database and message-broker credentials, exploit requires access to installation package and encrypted config file.

  • 8.8 /10 High
    CVE-2026-94422 No auth

    xdg-dbus-proxy - Remote Code Execution

    xdg-dbus-proxy < 0.1.9 contains a bypass of message filtering caused by improper handling of reply serial numbers on non-reply messages, letting malicious Flatpak apps execute arbitrary code outside their sandbox, exploit requires malicious or compromised Flatpak app.

  • 7.2 /10 High
    CVE-2026-93875 No auth

    JetAppointment WordPress Plugin - Stored XSS

    JetAppointment WordPress plugin <= 2.5.2.1 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'friendlyTime' parameter, letting unauthenticated attackers inject scripts executed in admin browser, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-93756 No auth

    Smash Balloon Social Post Feed - Stored Cross-Site Scripting & Remote Code Execution

    Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin <= 4.13.0 contains a stored XSS caused by insufficient input sanitization and output escaping in Facebook Comment Message via v-html in Admin Builder Preview, letting unauthenticated attackers inject scripts executing on admin feed builder preview, exploit requires attacker to have a Facebook account to post comments.