High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 329 of 568

  • 7.6 /10 High
    CVE-2026-94174 Auth required

    Email Log - SQL Injection

    Email Log <= 2.63 contains a SQL injection caused by unsanitized input in administrator functionality, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.

  • 8.5 /10 High
    CVE-2026-94124 Auth required

    WP EasyCart - SQL Injection

    WP EasyCart <= 5.9.4 contains a SQL injection caused by improper sanitization of user input, letting attackers execute arbitrary SQL queries, exploit requires contributor privileges.

  • 7.1 /10 High
    CVE-2026-93774 No auth

    WP Photo Album Plus - Reflected XSS

    WP Photo Album Plus <= 9.3.02.002 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 8.5 /10 High
    CVE-2026-93773 Auth required

    Mollie Forms - SQL Injection

    Mollie Forms <= 2.11.0 contains a SQL injection caused by unsanitized input in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-93622 CISA KEVNo auth

    WPS Limit Login - Stored XSS

    WPS Limit Login <= 1.5.9.3 contains an unauthenticated stored XSS caused by improper input sanitization, letting remote attackers execute scripts without authentication.

  • 8.5 /10 High
    CVE-2026-93527 Auth required

    Live Copy Paste for Elementor - SQL Injection

    Live Copy Paste for Elementor <= 1.5.10 contains a SQL injection caused by improper sanitization of user input, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-93526 No auth

    Event Tickets - Reflected XSS

    Event Tickets <= 5.29.4 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 8.1 /10 High
    CVE-2026-93508 Auth required

    WC Fields Factory WordPress Plugin - Broken Access Control

    WC Fields Factory WordPress plugin < 4.1.11 contains a broken access control vulnerability caused by improper restriction on field-management AJAX action, letting authenticated users with Subscriber-level access modify arbitrary post meta and pricing rules, exploit requires authenticated user with Subscriber-level or higher.

  • 7.5 /10 High
    CVE-2026-93368 No auth

    Rename wp-login.php to anything you want WordPress plugin - SQL Injection

    Rename wp-login.php to anything you want WordPress plugin <= 2.0.1 contains a time-based SQL injection caused by insufficient escaping of the 'log' username parameter, letting unauthenticated attackers extract sensitive database information.

  • 8.8 /10 High
    CVE-2026-93349 PoC publicNo auth

    Frictionless - Command Injection

    Frictionless <= 5.20.0rc1 contains a command injection caused by unsanitized shell metacharacters in resource path values within datapackage.json, letting attackers execute arbitrary OS commands as the user running the explore command, exploit requires attacker to supply a crafted Data Package descriptor.

  • 7.8 /10 High
    CVE-2026-91818

    Foxit PDF Editor/Reader - Denial of Service

    Foxit PDF Editor/Reader contains a use-after-free vulnerability caused by reentrant page-event processing during annotation enumeration, letting attackers cause application crashes, exploit requires triggering specific page events.

  • 7.8 /10 High
    CVE-2026-91816 No auth

    Foxit PDF Editor/Reader - Use After Free

    Foxit PDF Editor/Reader contains a use-after-free vulnerability caused by reentrant annotation deletion triggered by embedded JavaScript, letting attackers cause application crash, exploit requires embedded JavaScript execution.

  • 7.8 /10 High
    CVE-2026-91815 No auth

    Foxit PDF Editor/Reader - Remote Code Execution

    Foxit PDF Editor/Reader contains a buffer overflow caused by insufficient verification of JPEG2000 image metadata in PDF files, letting attackers cause crashes or execute arbitrary code remotely, exploit requires crafted PDF file.

  • 8.8 /10 High
    CVE-2026-91813 Auth required

    Foxit PDF Editor/Reader - Privilege Escalation

    Foxit PDF Editor/Reader contains a privilege escalation vulnerability caused by insufficient file locking and integrity validation in the update mechanism, letting local attackers execute arbitrary code with elevated privileges, exploit requires local access.

  • 7.9 /10 High
    CVE-2026-91812

    Foxit PDF Editor/Reader - Man-in-the-Middle

    Foxit PDF Editor/Reader contains a man-in-the-middle vulnerability caused by bypassing certificate validation and package integrity checks in the update mechanism, letting attackers execute arbitrary code with system privileges, exploit requires network interception.