High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 316 of 628
- 7.2 /10 HighCVE-2026-96344 Auth required
eCommerce Product Catalog - PHP Object Injection
eCommerce Product Catalog <= 3.6.0 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code via crafted objects, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-96343 Auth required
WP ERP - PHP Object Injection
WP ERP <= 1.17.9 contains a PHP Object Injection caused by unsafe handling of custom roles, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-95616 No auth
WSS4J - Denial of Service
WSS4J contains an integer overflow caused by improper DER bounds check allowing oversized allocation during X.509 certificate SubjectKeyIdentifier decoding, letting unauthenticated attackers exhaust server memory via crafted SOAP messages.
- 7.5 /10 HighCVE-2026-95587 No auth
Hostinger Migrator - Broken Access Control
Hostinger Migrator <= 1.0 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.
- 8.8 /10 HighCVE-2026-95531 Auth required
Conversational Forms for ChatBot - PHP Object Injection
Conversational Forms for ChatBot <= 1.5.0 contains a PHP object injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-94683 Auth required
DesignSetGo - PHP Object Injection
DesignSetGo <= 2.8.0 contains a PHP object injection caused by unsafe unserialization, letting attackers execute arbitrary code or manipulate application logic, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-94678 Auth required
Go Live Update Urls - PHP Object Injection
Go Live Update Urls <= 7.0.8 contains a PHP Object Injection caused by unsafe deserialization of user input, letting attackers execute arbitrary code remotely, exploit requires crafted input.
- 7.2 /10 HighCVE-2026-94677 Auth required
Kadence WooCommerce Email Designer - PHP Object Injection
Kadence WooCommerce Email Designer <= 1.5.19.1 contains a PHP Object Injection caused by unsafe deserialization, letting attackers inject malicious objects to execute arbitrary code, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-94499 Auth required
FormGent - Broken Access Control
FormGent <= 1.12.2 contains a broken access control vulnerability caused by improper authorization checks, letting attackers access or modify unauthorized resources, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-94178 Auth required
Import and export users and customers - Privilege Escalation
Import and export users and customers <= 2.5.2 contain a privilege escalation vulnerability caused by improper access control, letting attackers escalate their privileges, exploit requires user to be authenticated.
- 8.5 /10 HighCVE-2026-94177 Auth required
GamiPress - SQL Injection
GamiPress <= 8.0.2 contains an SQL injection caused by unsanitized input in database queries, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-94171 No auth
CURCY - Reflected XSS
CURCY <= 2.2.16 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-94123 No auth
NextGEN Gallery - Arbitrary File Download
NextGEN Gallery <= 4.5.0 contains an arbitrary file download vulnerability caused by insufficient access control, letting unauthenticated attackers download arbitrary files remotely, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-94122 Auth required
Responsive Slider Gallery - PHP Object Injection
Responsive Slider Gallery <= 1.5.5 contains a PHP object injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-94121 Auth required
10Web Booster – Website speed optimization, Cache & Page Speed optimizer - PHP Object Injection
10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.