High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 31 of 725

  • 7.1 /10 High
    CVE-2026-66090 Auth required

    openEQUELLA - XML External Entity Injection

    openEQUELLA < 2026.1 contains an XML external entity injection caused by enabled external entity resolution in the XML parser for item metadata, letting users with CREATE_ITEM permission read arbitrary files or perform SSRF, exploit requires CREATE_ITEM permission.

  • 7.1 /10 High
    CVE-2026-62374

    SD JWT JS - Authentication Bypass

    SD JWT JS <= 0.19.0 contains a broken authentication caused by silent dropping of tampered or invalid disclosures in @sd-jwt/decode, letting attackers manipulate claims without detection, exploit requires relying party not enforcing key binding.

  • 8.5 /10 High
    CVE-2026-61996 Auth required

    MLS On The Fly - SQL Injection

    MLS On The Fly <= 1.8.1.5 contains a SQL injection caused by unsanitized input in subscriber-related functionality, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-61995 No auth

    YouTube Showcase - Reflected XSS

    YouTube Showcase <= 4.1.0 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-61993 No auth

    Blockonomics - Reflected XSS

    Blockonomics 3.11.0 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-61989 No auth

    Easy Property Listings - Reflected XSS

    Easy Property Listings <= 3.5.25 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-61988 No auth

    Auction Nudge - Reflected XSS

    Auction Nudge - Your eBay on Your Site <= 8.4.0 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts on users, exploit requires no authentication.

  • 8.9 /10 High
    CVE-2026-61719 Auth required

    WeGIA - Stored XSS

    WeGIA < 3.8.7 contains a stored XSS caused by improper sanitization of the textoProntuario field in saude/historico_prontuarios.php, letting attackers with access to patient records execute scripts in victim browsers, exploit requires record access.

  • 8.1 /10 High
    CVE-2026-61671 Auth required

    WeGIA - Broken Access Control

    WeGIA < 3.8.7 contains a broken access control vulnerability caused by lack of record ownership verification and insufficient CSRF protection in Controle CRUD methods, letting authenticated users view, modify, or delete other users' sensitive records, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-61654 No auth

    Lightdash - Path Traversal

    Lightdash <= 0.3213.0 contains a path traversal vulnerability in the dbt Cloud webhook POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook caused by unsanitized accountId interpolation in server-side API requests, letting unauthenticated attackers influence API request paths and create previews, exploit requires knowledge of projectUuid in dbt Cloud IDE projects.

  • 8.3 /10 High
    CVE-2026-61576 No auth

    Lightdash - Path Traversal

    Lightdash <= 0.3213.0 contains a path traversal vulnerability in the dbt Cloud webhook POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook caused by unsanitized accountId interpolation in server-side API requests, letting unauthenticated attackers influence API request paths and create previews, exploit requires knowledge of projectUuid.

  • 7.1 /10 High
    CVE-2026-54866 No auth

    Razorpay Payment Button Elementor Plugin - Reflected XSS

    Razorpay Payment Button Elementor Plugin <= 1.2.8 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-54864 No auth

    Post Video Players - Reflected XSS

    Post Video Players <= 1.165 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-51905 Auth required

    TransformerOptimus SuperAGI - Broken Access Control

    TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability caused by missing organization ownership checks in get_agent_execution_configuration endpoint, letting remote authenticated attackers read other organizations' agent execution configurations, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-49142 Auth required

    OpenEMR - SQL Injection

    OpenEMR < 8.5.0 contains an authenticated SQL injection caused by crafted values in the form_icd_codes[] POST parameter in Syndromic Surveillance module, letting Clinician-level users read and modify database contents and take over admin accounts.