High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 356 of 568
- 8.8 /10 HighCVE-2026-93993 No auth
Mistral Vibe - Remote Code Execution
Mistral Vibe < 2.25.5 contains a remote code execution caused by execution of git hooks before trust validation in the worktree creation process, letting attackers execute arbitrary shell commands with user privileges, exploit requires crafted repository with malicious post-checkout hook.
- 8.1 /10 HighCVE-2026-93992 No auth
Gopeed - Path Traversal
Gopeed <= 2.0.0-beta.3 contains a path traversal vulnerability caused by improper validation in archive extraction, letting attackers write arbitrary files outside the extraction directory, exploit requires users to download and extract malicious archives with AutoExtract enabled.
- 7.7 /10 HighCVE-2026-93991 Auth required
Argo Workflows - Authorization Bypass
Argo Workflows 4.1.0 through 4.1.3 contain an authorization bypass caused by improper cluster-scoped access review in ListArchivedWorkflows with NotEquals namespace field selector, letting attackers with namespace-scoped list permissions access archived workflows across namespaces.
- 7.5 /10 HighCVE-2026-93990 No auth
Expat - XML Injection
Expat through 2.8.4 contains an XML injection vulnerability caused by failure to validate low surrogates following high surrogates in UTF-16 input, letting attackers craft malformed UTF-16 sequences to hide markup characters, exploit requires crafted UTF-16 encoded XML.
- 8.8 /10 HighCVE-2026-93923 No auth
SiYuan - Stored XSS
SiYuan through 3.8.4 contains a stored XSS caused by failure to escape heading style attributes in outline and bookmark dock HTML rendering, letting attackers execute scripts with full system access, exploit requires crafted notebooks or admin endpoint access.
- 8.8 /10 HighCVE-2026-93922 No auth
SiYuan - Stored XSS & Remote Code Execution
SiYuan <= 3.8.4 contains a stored cross-site scripting caused by rendering notebook names as raw HTML in the Daily Note picker dialog, letting attackers execute JavaScript with Node.js access and OS commands, exploit requires attacker to create notebooks with malicious names.
- 8.8 /10 HighCVE-2026-92807 Auth required
PDFCrowd Save as PDF Plugin - Arbitrary Function Invocation
PDFCrowd Save as PDF Plugin for WordPress <= 4.6.1 contains an arbitrary function invocation vulnerability caused by unsanitized pdf_created_callback shortcode attribute, letting authenticated contributors invoke arbitrary PHP functions, exploit requires Contributor-level access.
- 7.5 /10 HighCVE-2026-92404 No auth
MgoSync WordPress Plugin - Broken Access Control
MgoSync WordPress plugin < 2.1.7 contains a broken access control vulnerability caused by missing authorization on a REST API endpoint, letting unauthenticated users retrieve stored WooCommerce API credentials.
- 8.6 /10 HighCVE-2026-88926 No auth
VikRentItems Flexible Rental Management System WordPress plugin - SQL Injection
VikRentItems Flexible Rental Management System WordPress plugin < 1.2.4 contains a SQL injection caused by unsanitized and unescaped parameters in SQL statements, letting unauthenticated attackers execute arbitrary SQL queries remotely.
- 8.8 /10 HighCVE-2026-88824 No auth
Master Blocks WordPress plugin - Stored XSS
Master Blocks WordPress plugin < 1.5.0 contains a stored XSS caused by lack of authorization on a REST route allowing unauthenticated users to update settings with unescaped output, letting attackers execute scripts in admin sessions, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-87909 Auth required
WP Photo Album Plus - Remote Code Execution
WP Photo Album Plus plugin for WordPress contains a remote code execution caused by insufficient sanitization of multipart upload filename in wppa_image_magick function, letting authenticated attackers with subscriber-level access execute code on the server.
- 8.1 /10 HighCVE-2026-86814 No auth
UsersWP WordPress plugin - Authentication Bypass
UsersWP WordPress plugin < 1.5.10 contains an authentication bypass caused by lack of verification of social login provider email ownership, letting unauthenticated attackers log in as any user including administrators, exploit requires attacker to control a social login provider account with victim's email.
- 8.8 /10 HighCVE-2026-85680 No auth
Ultimate Member WordPress plugin - Stored XSS
Ultimate Member WordPress plugin < 2.13.1 contains a stored XSS caused by improper escaping and decoding of user-supplied profile names in page titles, letting unauthenticated attackers execute JavaScript when profiles are viewed, exploit requires attacker to register an account.
- 8.1 /10 HighCVE-2026-85658 Auth required
ProfilePress - Remote Code Execution
ProfilePress WordPress plugin <= 4.17.2 contains an arbitrary shortcode execution vulnerability caused by improper validation before running do_shortcode, letting authenticated subscribers and above execute arbitrary shortcodes.
- 8.0 /10 HighCVE-2026-85574 Auth required
Unbounce Landing Pages WordPress plugin - Broken Access Control
Unbounce Landing Pages WordPress plugin < 1.1.5 contains a broken access control vulnerability caused by lack of authorization checks when updating front-end proxy configuration, letting authenticated users modify proxy target, exploit requires user authentication.