High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 355 of 568
- 7.3 /10 HighCVE-2026-93972 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "courseID" argument in /reviewer_0/admins/assessments/course/btn_functions.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-93970 No auth
aiyiyi121 SxDevOps - Hardcoded Credentials
aiyiyi121 SxDevOps 1.0/1.1 contains a hardcoded credentials vulnerability caused by insecure handling in backend/sxdevops/settings.py Settings Handler, letting remote attackers access credentials, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-93969 No auth
aiyiyi121 SxDevOps - Hardcoded Credentials
aiyiyi121 SxDevOps 1.0/1.1 contains a hardcoded credentials vulnerability caused by manipulation in ensure_default_superuser function in rbac/services.py, letting remote attackers use fixed credentials, exploit requires no special privileges.
- 8.3 /10 HighCVE-2026-93962 No auth
Kamailio - Remote Code Execution
Kamailio <= 5.8.8/6.0.7/6.1.4/6.2.0-dev1 contains a heap-based buffer overflow caused by manipulation in shm_malloc function of CDP Diameter Receiver, letting remote attackers execute arbitrary code, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-93959 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "Course" argument in /reviewer_0/admins/assessments/course/btn_functions.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.2 /10 HighCVE-2026-92541 Auth required
Import and export users and customers WordPress plugin - Broken Access Control
Import and export users and customers WordPress plugin < 2.5.2 contains a broken access control vulnerability caused by lack of enforcement of promote_users capability in front-end import, letting users with create_users capability promote users to administrator, exploit requires user with create_users capability.
- 7.2 /10 HighCVE-2026-92540 Auth required
WordPress Import and export users and customers - Broken Access Control
WordPress Import and export users and customers plugin < 2.5.2 contains a broken access control caused by improper enforcement of promote_users capability during CSV import, letting users with create_users capability escalate privileges to administrator, exploit requires user to have create_users capability.
- 7.5 /10 HighCVE-2026-87839 No auth
Tripzzy WordPress - Broken Access Control
Tripzzy WordPress plugin < 1.5.1 contains a broken access control vulnerability caused by missing authorization checks and lack of identifier validation in an AJAX action, letting unauthenticated attackers delete arbitrary comments.
- 8.5 /10 HighCVE-2026-87067 Auth required
Forminator Forms - Remote Code Execution
Forminator Forms WordPress plugin < 1.57.2.1 contains an insecure deserialization vulnerability caused by unrestricted class instantiation from XML-RPC requests, letting users with forms-management permission write files and execute arbitrary code.
- 8.8 /10 HighCVE-2026-86553
SmartLife - Authentication Bypass
SmartLife app contains an authentication bypass caused by dynamic generation and misuse of authentication parameters in /account/verify.serv, letting attackers reset passwords by spoofing authentication and account ID, exploit requires attacker to acquire valid authentication parameters.
- 7.5 /10 HighCVE-2026-85017 Auth required
Unlimited Elements For Elementor - Insecure Deserialization
Unlimited Elements For Elementor WordPress plugin < 2.0.20 contains an insecure deserialization vulnerability caused by lack of capability check on an AJAX action, letting authenticated attackers with subscriber-level access inject arbitrary PHP objects.
- 8.1 /10 HighCVE-2026-82842
SAML Single Sign On WordPress plugin - Authentication Bypass
SAML Single Sign On WordPress plugin < 6.0.0 contains an authentication bypass caused by ignoring configured criteria for linking SSO identities, letting attackers authenticate as any account by asserting arbitrary login names, exploit requires control over identity provider assertions.
- 7.2 /10 HighCVE-2026-81650 Auth required
Photo Gallery, Sliders, Proofing WordPress plugin - Unrestricted File Upload
Photo Gallery, Sliders, Proofing WordPress plugin < 4.5.0 contains a file upload vulnerability caused by improper validation of file extensions in extracted archives, letting users with gallery-management capability write arbitrary files and execute code, exploit requires gallery-management capability.
- 7.5 /10 HighCVE-2026-94056
Exim - Information Disclosure
Exim < 4.100.1 contains an information disclosure vulnerability caused by uninitialized stack memory read when Proxy-Protocol is used with an attacker-controlled proxy, letting attackers read sensitive data, exploit requires attacker-controlled proxy.
- 7.0 /10 HighCVE-2026-94054
Exim - Buffer Overflow
Exim < 4.100.1 contains a buffer overflow caused by out-of-bounds write when Proxy-Protocol is used with an attacker-controlled proxy, letting remote attackers cause memory corruption, exploit requires attacker-controlled proxy.