High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 30 of 725

  • 7.5 /10 High
    CVE-2026-93904 No auth

    Social Web Suite Social Media Auto Post - SQL Injection

    Social Web Suite Social Media Auto Post, Social Media Auto Publish plugin for WordPress <= 4.1.12 contains a SQL injection caused by insufficient escaping of 'exclude_posts' parameter and bypassable HMAC authentication, letting unauthenticated attackers extract sensitive database information, exploit requires unvisited settings page on fresh install.

  • 7.5 /10 High
    CVE-2026-93855 No auth

    SendPress Newsletters - SQL Injection

    SendPress Newsletters WordPress plugin <= 1.26.1.20 contains a time-based SQL injection caused by insufficient escaping of 'subscriberid' parameter and weak nonce protection, letting unauthenticated attackers extract sensitive database information, exploit requires nonce bypass via public shortcode.

  • 7.5 /10 High
    CVE-2026-93757 Auth required

    Wild Apricot Login - Authentication Bypass

    Wild Apricot Login plugin for WordPress <= 1.0.18 contains an authentication bypass via SSO email-collision account binding caused by insufficient verification in user mapping and session cookie issuance, letting attackers with matching WildApricot email authenticate as WordPress administrators, exploit requires attacker-controlled WildApricot contact with victim's email and SSO login completion.

  • 8.2 /10 High
    CVE-2026-93570 No auth

    Szafir - XML External Entity Injection

    Szafir and Szafir Weryfikująca contain an XML External Entity (XXE) injection caused by processing external entities in crafted XML files with DOCTYPE external DTD references, letting attackers read arbitrary files, exploit requires crafted XML input.

  • 8.7 /10 High
    CVE-2026-92744 PoC public

    Privilege Manager Agent - Remote Code Execution & Privilege Escalation

    Privilege Manager Agent contains a remote code execution caused by improper access control, letting remote unauthenticated attackers execute arbitrary code as LocalSystem, exploit requires specific conditions.

  • 7.4 /10 High
    CVE-2026-92092

    OpenShift Ansible - Command Injection

    OpenShift Ansible installer container contains a command injection caused by downloading and executing remote scripts without integrity verification, letting remote attackers execute arbitrary code with cluster-provisioning privileges, exploit requires network interception or compromised HTTP server.

  • 7.5 /10 High
    CVE-2026-90869 No auth

    Progress Software WS_FTP Server - Denial of Service

    Progress Software WS_FTP Server < 2024.0.7 and < 2025.0.4 on Windows contains a denial of service caused by improper handling of SSH public key termination requests, letting remote attackers terminate the shared SSH service, exploit requires knowledge of a valid account's enrolled SSH public key.

  • 8.1 /10 High
    CVE-2026-90867 No auth

    Progress Software WS_FTP Server - Broken Access Control

    Progress Software WS_FTP Server < 2024.0.7 and < 2025.0.4 on Windows contains an improper access control vulnerability in the Web Admin console, letting remote attackers access administrative functionality, exploit requires authentication.

  • 7.5 /10 High
    CVE-2026-8824 No auth

    vtk - Buffer Overflow

    vtk 9.6.1 contains a buffer overflow caused by improper handling of specially crafted .bmp files in vtkBMPReader ExecuteDataWithInformation, letting attackers trigger memory corruption remotely, exploit requires malicious file input.

  • 7.5 /10 High
    CVE-2026-8822 No auth

    vtk - Buffer Overflow

    vtk 9.6.1 contains a buffer overflow caused by improper handling of specially crafted USGS DEM files in vtkDEMReader ReadProfiles functionality, letting attackers trigger memory corruption by providing malicious files.

  • 8.8 /10 High
    CVE-2026-88077 No auth

    Microsoft Edge - Privilege Escalation

    Microsoft Edge (Chromium-based) contains an integer overflow caused by improper handling of integer values, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-85899 Auth required

    Microsoft Edge - Privilege Escalation

    Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows authorized attackers to elevate privileges over a network, exploit requires attacker authorization.

  • 8.8 /10 High
    CVE-2026-85897 No auth

    Microsoft Edge - Remote Code Execution

    Microsoft Edge (Chromium-based) contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-85890 No auth

    Microsoft Edge - Remote Code Execution

    Microsoft Edge (Chromium-based) contains a double free vulnerability caused by improper memory management, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 7.7 /10 High
    CVE-2026-84294 Auth required

    Progress Software WS_FTP Server - Path Traversal

    Progress Software WS_FTP Server < 2024.0.6 and < 2025.0.3 on Windows contains a path traversal caused by improper limitation of pathname in the Ad Hoc Transfer component, letting authenticated users access files outside intended directories.