High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 304 of 628

  • 7.2 /10 High
    CVE-2026-10026 Auth required

    CTX Feed Pro WordPress - Code Injection

    CTX Feed Pro WordPress plugin <= 7.6.12 contains a code injection caused by insufficient input validation on the 'Feed Config' field passed to eval(), letting authenticated administrators execute arbitrary PHP code on the server.

  • 7.2 /10 High
    CVE-2026-100182 No auth

    Download Monitor WordPress Plugin - Stored XSS

    Download Monitor WordPress plugin <= 5.2.10 contains a stored XSS caused by insufficient input sanitization and output escaping in postMessage to Admin Editor, letting unauthenticated attackers inject scripts via tricking an admin, exploit requires admin interaction.

  • 7.2 /10 High
    CVE-2026-100107 No auth

    Kubio AI Page Builder - Stored XSS

    Kubio AI Page Builder WordPress plugin <= 2.9.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts executed on page access.

  • 7.5 /10 High
    CVE-2020-37278 CISA KEVNo auth

    Weaver e-Bridge - Arbitrary File Read & Server-Side Request Forgery

    Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability caused by improper validation of the downloadUrl parameter in the saveYZJFile endpoint, letting remote attackers read sensitive files and perform server-side request forgery, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2014-125130 CISA KEVNo auth

    CodeArt Google MP3 Audio Player - Path Traversal

    CodeArt Google MP3 Audio Player plugin for WordPress through 1.0.11 contains a path traversal vulnerability caused by insufficient validation of the file parameter in direct_download.php, letting remote attackers read arbitrary files without authentication.

  • 8.2 /10 High
    CVE-2026-97662 No auth

    AWS security-agent-mcp-server - Arbitrary File Write

    AWS security-agent-mcp-server < 0.2.0 contains a file write vulnerability caused by argument injection in the diff scan operation, letting context-dependent threat actors create, overwrite, or truncate arbitrary files outside the intended workspace, exploit requires crafted reference value.

  • 7.2 /10 High
    CVE-2026-97661 No auth

    Business Essentials for Contact Form 7 - Stored XSS

    Business Essentials for Contact Form 7 WordPress plugin <= 1.2.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'gateway' form field, letting unauthenticated attackers execute arbitrary scripts, exploit requires Payments module enabled and form configured for PayPal and Stripe.

  • 7.6 /10 High
    CVE-2026-97297 Auth required

    Gratisfaction - Broken Access Control

    Gratisfaction <= 4.6.3 contains a broken access control vulnerability, letting attackers bypass authorization and access restricted resources, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-97284 Auth required

    Icegram - PHP Object Injection

    Icegram <= 3.1.31 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 7.6 /10 High
    CVE-2026-97277 Auth required

    Social Boost - Broken Access Control

    Social Boost <= 3.6.2 contains a broken access control vulnerability, letting attackers bypass authorization and access restricted resources, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-97273 No auth

    Premmerce Wishlist for WooCommerce - Reflected XSS

    Premmerce Wishlist for WooCommerce <= 1.1.13 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-97268 No auth

    Premmerce Wishlist for WooCommerce - Reflected XSS

    Premmerce Wishlist for WooCommerce <= 1.1.13 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-97260 No auth

    MaxGalleria - Reflected XSS

    MaxGalleria <= 6.5.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-96813 No auth

    Form Maker by 10Web - Stored XSS

    Form Maker by 10Web WordPress plugin <= 1.15.47 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Mark on Map Longitude/Latitude fields, letting unauthenticated attackers inject scripts executed on page access.

  • 7.1 /10 High
    CVE-2026-96577

    oc-mirror - Broken Access Control

    oc-mirror contains an unrestricted network binding in the embedded local cache registry, letting unauthenticated adjacent network attackers push tampered images, delete cache, or access mirrored content, exploit requires network adjacency.