High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 328 of 568

  • 7.2 /10 High
    CVE-2026-95603 Auth required

    Reycob Product Import Export - PHP Object Injection

    Reycob Product Import Export <= 2.3.0 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.6 /10 High
    CVE-2026-95593 Auth required

    Ultimeter - SQL Injection

    Ultimeter <= 3.0.8 contains a SQL injection caused by improper sanitization in the Editor component, letting attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-95590 Auth required

    Tainacan - SQL Injection

    Tainacan <= 1.2.0 contains a SQL injection caused by improper sanitization of subscriber input, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-95529 No auth

    Calculated Fields Form - Reflected XSS

    Calculated Fields Form <= 5.5.1.1 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-95528 No auth

    Core Web Vitals & PageSpeed Booster - Reflected XSS

    Core Web Vitals & PageSpeed Booster <= 1.0.31 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts, exploit requires no authentication.

  • 7.6 /10 High
    CVE-2026-95522 Auth required

    Easy Digital Downloads - SQL Injection

    Easy Digital Downloads <= 3.7.0 contains a SQL injection caused by improper sanitization of input in Shop Manager component, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-95515 No auth

    Ninja Forms - Reflected XSS

    Ninja Forms <= 3.15.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-95513 No auth

    Online Booking & Scheduling Calendar for WordPress by vcita - Broken Access Control

    Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 contains a broken access control vulnerability caused by improper authorization checks, letting unauthenticated attackers access restricted functionality, exploit requires no authentication.

  • 8.1 /10 High
    CVE-2026-94487 No auth

    PublishPress Capabilities - Cross Site Request Forgery

    PublishPress Capabilities <= 2.50.1 contains an unauthenticated cross site request forgery caused by lack of proper request validation, letting remote attackers perform unauthorized actions, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-94367 Auth required

    OpenEye Apex Network Video Recorder - Command Injection

    OpenEye Apex Network Video Recorder (NVR) firmware >= 2.2.3.4 and < 3.5.4 contains a command injection caused by crafted backup-area configuration input in recbackup, letting authenticated administrators execute OS commands as nvr user.

  • 7.3 /10 High
    CVE-2026-94243 No auth

    Apache Sling Security Bundle - Broken Access Control

    Apache Sling Security Bundle < 1.3.2 contains a security filter weakness caused by ReferrerFilter accepting weaker-than-origin evidence, letting attackers bypass referrer checks, exploit requires crafted requests.

  • 7.4 /10 High
    CVE-2026-94183 No auth

    Arc Search - UI Spoofing

    Arc Search for Android < 1.12.10 contains a UI spoofing vulnerability caused by lack of fullscreen notification when a page enters fullscreen mode in background, letting remote attackers render fake UI elements to mislead users, exploit requires user to visit a crafted website.

  • 7.4 /10 High
    CVE-2026-94181 No auth

    Arc - UI Redress & Spoofing

    Arc browser contains an address bar spoofing vulnerability caused by a <select> element triggering requestFullscreen without showing fullscreen notification, letting attackers spoof the browser address bar, exploit requires no special conditions.

  • 7.1 /10 High
    CVE-2026-94179 No auth

    Razorpay Payment Button - Reflected XSS

    Razorpay Payment Button <= 2.4.9 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-94176 No auth

    Mang Board WP - Stored XSS

    Mang Board WP <= 2.4.1 contains an unauthenticated stored cross site scripting caused by improper input sanitization, letting remote attackers execute scripts without authentication.