High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 314 of 628

  • 7.5 /10 High
    CVE-2026-97240 No auth

    StifLi Backup Tools - Sensitive Data Exposure

    StifLi Backup Tools <= 2.2.7 contains an information disclosure vulnerability caused by unauthenticated access, letting remote attackers expose sensitive data, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-97237 No auth

    JetEngine - Stored XSS

    JetEngine <= 3.8.14.3 contains an unauthenticated stored cross site scripting caused by improper input sanitization, letting unauthenticated attackers execute scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-97235 No auth

    ThemeREX Addons - Reflected XSS

    ThemeREX Addons < 2.45.0 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-97197 No auth

    WordPress Backup & Migration - Broken Access Control

    WordPress Backup & Migration <= 1.6.0 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 7.2 /10 High
    CVE-2026-97150 Auth required

    baserCMS BcAddonMigrator - File Inclusion

    baserCMS BcAddonMigrator contains an arbitrary file read and deletion vulnerability caused by inclusion and execution of addon config.php files, letting administrative users read or delete arbitrary files, exploit requires administrative privileges.

  • 7.1 /10 High
    CVE-2026-97077 No auth

    Ad Inserter - Reflected XSS

    Ad Inserter <= 2.8.18 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-97065 No auth

    Happyforms - Reflected XSS

    Happyforms <= 1.26.15 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-96838 No auth

    Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification - Cross Site Request Forgery

    Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 contains an unauthenticated cross site request forgery caused by lack of proper request validation, letting unauthenticated attackers perform unauthorized actions, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-96837 Auth required

    CartFlows - Remote Code Execution

    CartFlows <= 3.2.0 contains a remote code execution caused by improper input handling, letting remote attackers execute arbitrary code, exploit requires crafted request.

  • 7.1 /10 High
    CVE-2026-96836 No auth

    Parsi Date - Stored XSS

    Parsi Date <= 6.3 contains an unauthenticated stored cross site scripting caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-96833 Auth required

    Ultimate Addons for Contact Form 7 - PHP Object Injection

    Ultimate Addons for Contact Form 7 <= 3.5.51 contains a PHP object injection caused by unsafe deserialization in the Editor component, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-96832 Auth required

    Content Egg - PHP Object Injection

    Shop manager PHP Object Injection in Content Egg <= 6.3.1 contains a PHP object injection vulnerability caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-96831 Auth required

    Themify Builder - PHP Object Injection

    Themify Builder <= 7.8.1 contains a PHP Object Injection caused by unsafe unserialize usage, letting attackers inject arbitrary objects, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-96830 No auth

    GiveWP - Reflected XSS

    GiveWP <= 4.16.9 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no special privileges.

  • 7.6 /10 High
    CVE-2026-96828 Auth required

    Category Discount WooCommerce - SQL Injection

    Category Discount WooCommerce <= 5.18 contains an SQL injection caused by improper sanitization of administrator inputs, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.