High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 312 of 628

  • 8.5 /10 High
    CVE-2026-103247 Auth required

    n8n - Broken Access Control

    n8n < 1.123.80 contains a credential tampering vulnerability caused by duplicate node IDs bypassing workflow credential tamper guard, letting attackers with editor access retain victim credentials and redirect secrets.

  • 7.7 /10 High
    CVE-2026-103246 Auth required

    n8n - Broken Access Control

    n8n < 2.39.6 and 2.40.0 < 2.40.1 contain an information disclosure vulnerability caused by failure to validate credential ownership during inline agent node-tool introspection, letting attackers decrypt and exfiltrate plaintext secrets without ownership verification.

  • 7.2 /10 High
    CVE-2026-103082 No auth

    LA-Studio LA-Studio Element Kit for Elementor - Server Side Request Forgery

    LA-Studio LA-Studio Element Kit for Elementor <= 1.6.2 contains a server side request forgery caused by improper validation of URLs, letting attackers make arbitrary requests from the server, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-103068 Auth required

    ByteCoreStack MCP Connector for AI Tools - Privilege Escalation

    ByteCoreStack MCP Connector for AI Tools <= 1.2.2 contains a privilege escalation vulnerability caused by improper subscriber privilege management, letting attackers escalate their privileges, exploit requires subscriber access.

  • 8.0 /10 High
    CVE-2026-103067 Auth required

    Memberful Memberful - Membership Plugin - Cross Site Request Forgery

    Memberful Memberful - Membership Plugin <= 1.81.0 contains a cross site request forgery vulnerability caused by insufficient request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 8.3 /10 High
    CVE-2026-102667 No auth

    Joyland AI - Stored XSS

    Joyland AI app contains a stored XSS caused by JavaScript injection in WebView content, letting attackers with shared network access execute scripts and access sensitive resources, exploit requires network access.

  • 8.4 /10 High
    CVE-2026-102514 No auth

    PeaZip - Remote Code Execution

    PeaZip <= 11.2.0 contains an out-of-bounds write caused by improper validation of the first block compressed size in the PEA archive extraction routine, letting attackers execute arbitrary code by opening crafted .pea archives, exploit requires victim to open or extract the archive.

  • 7.5 /10 High
    CVE-2026-102504 No auth

    Perl Imager - Denial of Service

    Perl Imager < 1.037 contains a denial of service caused by lack of range checking on raw_datachannels in i_readraw_wiol, letting attackers trigger uncatchable process exit by passing crafted raw_datachannels value, exploit requires attacker to provide untrusted input.

  • 8.5 /10 High
    CVE-2026-102379 Auth required

    VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder - SQL Injection

    VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder <= 1.0.28 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-102378 No auth

    Parallax Section - Reflected XSS

    Parallax Section block <= 2.0.4 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-101888 Auth required

    Prime Mover WordPress - Path Traversal

    Prime Mover WordPress plugin < 2.2.1 contains a path traversal caused by improper ZIP entry name validation in migration ZIP import, letting authenticated administrators write arbitrary files outside intended directories, potentially leading to remote code execution.

  • 8.8 /10 High
    CVE-2026-101147 No auth

    Featured Image from URL (FIFU) WordPress Plugin - Cross-Site Request Forgery

    Featured Image from URL (FIFU) WordPress plugin < 6.0.8 and FIFU Premium < 8.2.8 contain a cross-site request forgery caused by improper REST API nonce enforcement, letting attackers make logged-in administrators perform any REST API action via crafted URLs.

  • 7.5 /10 High
    CVE-2026-100517 No auth

    WooCommerce Photo Reviews - Broken Access Control

    WooCommerce Photo Reviews <= 1.2.30 contains an insecure direct object reference caused by lack of proper access control, letting unauthenticated attackers access or modify unauthorized data.

  • 7.5 /10 High
    CVE-2026-100514 No auth

    Log REST API - Broken Access Control

    Log REST API <= 1.7.2 contains an insecure direct object reference caused by lack of proper access control, letting unauthenticated attackers access or modify unauthorized data.

  • 7.5 /10 High
    CVE-2024-58388 CISA KEVNo auth

    Sharp & Toshiba Tec Multifunction Printers - Local File Inclusion

    Sharp and Toshiba Tec multifunction printers contain an unauthenticated local file inclusion caused by manipulation of the path parameter in installed_emanual_down.html, letting remote attackers read arbitrary files via directory traversal.