High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 3 of 552
- 7.2 /10 HighCVE-2026-96768 No auth
GoSMTP Pro - Stored XSS
GoSMTP Pro WordPress plugin <= 1.2.3 contains a stored XSS caused by insufficient input sanitization and output escaping in email log body, letting unauthenticated attackers inject scripts executed when users access injected pages.
- 7.5 /10 HighCVE-2026-107746 No auth
FunnelKit – Funnel Builder for WooCommerce Checkout - Authorization Bypass
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.16.0.6 contains an authorization bypass caused by improper user authorization verification in shortcode rendering, letting unauthenticated attackers retrieve billing PII via sequential order IDs, exploit requires FunnelKit thank-you page with specific shortcodes.
- 8.8 /10 HighCVE-2026-111382 No auth
FreeRDP - Out of Bounds Read/Write
FreeRDP < 3.32.0 contains a client-side heap out-of-bounds write vulnerability caused by improper handling of RDPGFX AVC444 or AVC444v2 frames in general_LumaToYUV444 and general_ChromaV2ToYUV444, letting malicious RDP servers corrupt client memory and potentially execute code, exploit requires attacker-controlled RDP server.
- 8.8 /10 HighCVE-2026-111380 No auth
FreeRDP - Integer Overflow
FreeRDP 3.29.0 before 3.32.0 contains an integer overflow in Apple audin backends caused by improper UINT32 arithmetic in audio buffer size calculation, letting malicious RDP servers cause heap out-of-bounds write on macOS and iOS clients, exploit requires malicious RDP server.
- 7.5 /10 HighCVE-2026-111378 No auth
FreeRDP - Denial of Service
FreeRDP 3.0.0 < 3.32.0 contains an uncontrolled resource consumption vulnerability caused by improper handling in parse_nla_mode_pdu, letting unauthenticated attackers exhaust server memory by sending malformed TLS streams, exploit requires no authentication.
- 7.7 /10 HighCVE-2026-111389 PoC publicAuth required
Frappe HRMS - SQL Injection
Frappe HRMS 14.x < 14.38.2, 15.x < 15.64.0, and 16.x < 16.18.0 contain a SQL injection caused by missing input validation in some endpoints, letting authenticated attackers extract sensitive database information.
- 7.5 /10 HighCVE-2026-103525 No auth
FluentCart WordPress - Broken Access Control
FluentCart WordPress plugin <= 1.7.0 contains an insecure direct object reference caused by missing validation on user-controlled order_id and address_id parameters, letting unauthenticated attackers access other customers' billing and shipping PII by enumerating IDs.
- 7.0 /10 HighCVE-2026-105228 No auth
Delta ISPSoft - Information Disclosure
Delta ISPSoft contains an information disclosure vulnerability allowing remote attackers to access sensitive information, exploit requires no special privileges.
- 7.0 /10 HighCVE-2026-105227 No auth
Delta ISPSoft - Information Disclosure
Delta ISPSoft contains an information disclosure vulnerability allowing remote attackers to access sensitive information, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-110701 No auth
CP Multi View Events Calendar - Stored XSS
CP Multi View Events Calendar WordPress plugin <= 1.4.42 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'CalendarTitle' parameter, letting unauthenticated attackers inject scripts, exploit requires 'Allow edition in frontend?' enabled by admin.
- 7.2 /10 HighCVE-2026-97339 No auth
Complianz GDPR/CCPA Cookie Consent Banner - Stored XSS
Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress <= 7.5.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content via yotu-wp Cookie-Blocker Filter, letting unauthenticated attackers inject scripts executed by users visiting approved comments.
- 7.2 /10 HighCVE-2026-107758 No auth
Colibri Page Builder - Stored XSS
Colibri Page Builder WordPress plugin <= 1.0.390 contains a stored cross-site scripting caused by insufficient sanitization of 'comment' parameter allowing unauthenticated attackers to inject scripts executed on page load.
- 7.8 /10 HighCVE-2026-104715 PoC publicAuth required
cifs-utils - Privilege Escalation
cifs-utils contains a privilege escalation caused by improper sanitization of user-controlled credentials file during CIFS share mount, letting unprivileged local users execute files with root privileges, exploit requires local access.
- 8.6 /10 HighCVE-2026-14452 No auth
Checkmk - Stored XSS & Open Redirect
Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51, and 2.2.0 contain a stored XSS and open redirect caused by improper validation of the reset_url parameter in Setup in-page search, letting attackers execute scripts or redirect authenticated users with Setup access, exploit requires user interaction.
- 7.3 /10 HighCVE-2026-111210 No auth
bitcoinj - Server Side Request Forgery
bitcoinj <= 0.17 contains a server-side request forgery caused by manipulation of the "pki_type" argument in PaymentSession.java Payment Request Handler, letting remote attackers make arbitrary server requests, exploit requires crafted input.