High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 298 of 628

  • 7.2 /10 High
    CVE-2026-93367 No auth

    Visitors Traffic Real Time Statistics Pro - Stored XSS

    Visitors Traffic Real Time Statistics Pro WordPress plugin <= 11.22 contains a stored XSS caused by unsanitized 'page_title' parameter in ahcpro_track_visitor AJAX action, letting unauthenticated attackers execute arbitrary JavaScript in admin sessions.

  • 8.1 /10 High
    CVE-2026-92820 No auth

    Ninja Forms - File Uploads - Arbitrary File Operations

    Ninja Forms - File Uploads plugin for WordPress <= 3.3.34 contains arbitrary file operations caused by unvalidated attacker-supplied file paths in the external Amazon S3 upload flow, letting unauthenticated attackers read, write, or delete arbitrary files, exploit requires External File Upload action and Email action for read.

  • 7.5 /10 High
    CVE-2026-92174 Auth required

    SiteOrigin Widgets Bundle - Local File Inclusion

    SiteOrigin Widgets Bundle plugin for WordPress <= 1.73.2 contains a local file inclusion caused by improper validation of the 'theme' parameter in /wp-json/sowb/v1/widgets/previews, letting authenticated contributors include and execute arbitrary PHP files, exploit requires crafted widgetData payload with legacy theme key and non-empty columns array.

  • 7.5 /10 High
    CVE-2026-91828 No auth

    OMGF WordPress Plugin - Denial of Service

    OMGF WordPress plugin < 6.3.11 contains a denial of service caused by unauthenticated slow server-side loopback requests, letting unauthenticated attackers exhaust PHP worker pool and make the site unavailable, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-90438 No auth

    Ninja Forms - Stored Cross-Site Scripting

    Ninja Forms WordPress plugin <= 3.15.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Paragraph Text (RTE) field, letting unauthenticated attackers inject scripts executed on user page access, exploit requires RTE enabled on Paragraph Text field.

  • 7.2 /10 High
    CVE-2026-87920 No auth

    W3 Total Cache WordPress Plugin - Stored XSS

    W3 Total Cache WordPress plugin <= 2.10.6 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content via output-buffer regex rewrite, letting unauthenticated attackers inject scripts, exploit requires 'Remove query strings from static resources' option enabled.

  • 7.5 /10 High
    CVE-2026-85494 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains multiple vulnerabilities including improper length parameter handling, uncaught exceptions, inefficient algorithmic complexity, excessive memory allocation, and insecure resource initialization, letting attackers cause denial of service or resource exhaustion, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-85215 Auth required

    GG Soft Software Services Inc. Paperwork - SQL Injection

    GG Soft Software Services Inc. Paperwork <= 2026-09-09 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 7.7 /10 High
    CVE-2026-82044 Auth required

    UTMStack - Server-Side Request Forgery

    UTMStack < 11.2.16 contains a server-side request forgery caused by unvalidated URL parameter in PdfService.downloadPdf() method via GET /api/generate-pdf-report, letting authenticated attackers access internal resources and sensitive data.

  • 8.8 /10 High
    CVE-2026-82039 Auth required

    UTMStack - SQL Injection

    UTMStack before 11.2.16 contains a sql injection caused by unsanitized assetType and groupName values in UtmAssetGroupService.searchQueryBuilder(), letting authenticated attackers execute arbitrary SQL with DBA privileges via GET /api/utm-asset-groups/searchGroupsByFilter.

  • 7.4 /10 High
    CVE-2026-80443 No auth

    HAVELSAN Inc. Sef - AI Chatbot Platform - Man-in-the-Middle

    HAVELSAN Inc. Sef - AI Chatbot Platform < 2.1 contains an insecure certificate validation vulnerability caused by improper validation, letting adversaries perform man-in-the-middle attacks, exploit requires network access to intercept communications.

  • 8.8 /10 High
    CVE-2026-80298 Auth required

    HAVELSAN Inc. Sef - AI Chatbot Platform - SQL Injection

    HAVELSAN Inc. Sef - AI Chatbot Platform < 2.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-67989 No auth

    crmne/ruby_llm - Denial of Service

    crmne/ruby_llm contains a regular expression denial-of-service caused by polynomial-time regex in Mistral model capability matching on Ruby 3.1.x, letting attackers cause denial of service, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-66055 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains an allocation of resources without limits or throttling vulnerability, letting attackers exhaust system resources, exploit requires no special conditions.

  • 8.7 /10 High
    CVE-2026-63772 No auth

    Apache Thrift - Denial of Service

    Apache Thrift < 0.25.0 contains an allocation of resources without limits or throttling vulnerability caused by lack of resource management in Go bindings, letting attackers exhaust resources, exploit requires network access.