High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 339 of 568
- 7.3 /10 HighCVE-2026-93928 No auth
Magepeople inc. Taxi Booking Manager for WooCommerce - Authentication Bypass
Magepeople inc. Taxi Booking Manager for WooCommerce < 2.0.8 contains an authentication bypass caused by use of an alternate path or channel, letting attackers bypass authentication, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-93836 CISA KEVNo auth
WPC Product Bundles for WooCommerce - Stored XSS
WPC Product Bundles for WooCommerce <= 8.6.6 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of the 'qty' parameter, letting unauthenticated attackers inject and execute arbitrary scripts when users access affected pages.
- 7.2 /10 HighCVE-2026-93778 No auth
WP Yelp Review Slider - Stored XSS
WP Yelp Review Slider for WordPress <= 9.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Yelp Review Text, letting unauthenticated attackers inject scripts executed by users, exploit requires use of Download Reviews feature.
- 7.5 /10 HighCVE-2026-93712 No auth
Dancer2 - Path Traversal
Dancer2 2.1.0 before 2.2.0 for Perl contains a path traversal caused by improper handling of relative path segments in the File route handler, letting unauthenticated attackers read arbitrary files outside public_dir, exploit requires enabling File route handler with static_handler set to 0.
- 7.5 /10 HighCVE-2026-93710
Dancer2 - Broken Access Control
Dancer2 2.0.0 before 2.2.0 contains a broken access control vulnerability caused by improper handling of dying hooks in compile_hooks, letting attackers bypass route refusal and execute unintended route code, exploit requires crafted hook behavior.
- 7.5 /10 HighCVE-2026-93345 No auth
MikroTik RouterOS - Denial of Service
MikroTik RouterOS < 7.25beta4 contains an improper input validation vulnerability in labelled-VPN NLRI iterators of the routing service, letting unauthenticated on-path attackers crash the BGP service by sending malformed MP_REACH_NLRI UPDATE messages with invalid prefix-lengths.
- 8.1 /10 HighCVE-2026-92969 No auth
HUSKY Products Filter for WooCommerce Professional - Local File Inclusion
HUSKY Products Filter for WooCommerce Professional <= 1.4.4 contains a local file inclusion caused by improper validation of the 'shortcode' parameter, letting unauthenticated attackers execute arbitrary PHP files, exploit requires nonce obtainable from front-end JavaScript.
- 8.8 /10 HighCVE-2026-92438 No auth
Ninja Forms - Stored XSS
Ninja Forms WordPress plugin 3.15.3 contains a stored XSS caused by unescaped submitted form field values on the submission edit screen, letting unauthenticated users execute scripts in high-privileged users' browsers, exploit requires form submission.
- 7.5 /10 HighCVE-2026-9231 Auth required
WP Travel Engine – Tour Booking Plugin – Tour Operator Software - Local File Inclusion
WP Travel Engine – Tour Booking Plugin – Tour Operator Software for WordPress <= 6.8.0 contains a local file inclusion caused by improper handling in wte_get_template function, letting authenticated contributors and above execute arbitrary PHP files, exploit requires contributor-level access or higher.
- 8.1 /10 HighCVE-2026-92235 Auth required
WP Ultimate Review - Stored XSS
WP Ultimate Review plugin for WordPress <= 2.4.2 contains a stored XSS caused by improper validation before running do_shortcode, letting authenticated attackers with subscriber-level access execute arbitrary shortcodes.
- 7.5 /10 HighCVE-2026-91827 No auth
Ninja Forms - Insecure Deserialization
Ninja Forms WordPress plugin 3.15.3 contains a PHP Object Injection caused by deserialization of user-submitted form field values during CSV export by administrators, letting unauthenticated attackers perform arbitrary file operations or remote code execution if a suitable POP chain exists.
- 8.8 /10 HighCVE-2026-91018 No auth
lwIP - Use After Free
lwIP contains a double free vulnerability caused by improper memory management, letting attackers cause denial of service, memory corruption, or remote code execution, exploit requires no special conditions.
- 7.2 /10 HighCVE-2026-89412 No auth
TranslatePress - Stored Cross-Site Scripting
TranslatePress WordPress plugin <= 3.3.5 contains a stored cross-site scripting caused by insufficient input sanitization in Translation Memory Suggestion Panel, letting unauthenticated attackers inject scripts executed in admin sessions, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-89407 No auth
FasterXML jackson-core - Denial of Service
FasterXML jackson-core >= 2.17.0 contains a denial of service vulnerability caused by inefficient regex backtracking in NumberInput.looksLikeValidNumber(), letting attackers supply crafted JSON to exhaust server resources, exploit requires deserialization of large numeric strings.
- 8.4 /10 HighCVE-2026-89281
Apache Lounge Apache HTTP Server - Code Execution
Apache Lounge Windows distribution of Apache HTTP Server contains a hardcoded configuration path vulnerability in openssl.cnf, letting local attackers execute code, exploit requires local access.