High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 357 of 568
- 7.5 /10 HighCVE-2026-82560 No auth
Pod::Text - Denial of Service
Pod::Text < 6.1.1 for Perl contains a denial of service caused by excessive =over nesting in POD documents, letting attackers exhaust CPU and memory by formatting crafted documents, exploit requires processing attacker-supplied POD.
- 7.1 /10 HighCVE-2026-76790 No auth
Estatik Real Estate Plugin - Reflected XSS
Estatik Real Estate Plugin WordPress plugin < 4.3.5 contains a reflected XSS caused by unsanitized and unescaped values decoded from a request parameter in an unauthenticated AJAX response, letting unauthenticated attackers execute scripts.
- 7.2 /10 HighCVE-2026-76554 Auth required
WP Import Export Lite WordPress plugin - Broken Access Control
WP Import Export Lite WordPress plugin < 3.9.35 contains a broken access control vulnerability caused by lack of verification for user import permissions, letting delegated users create or modify administrator accounts, exploit requires delegated import permission.
- 8.8 /10 HighCVE-2026-4327 Auth required
Welcomizer WordPress Plugin - Remote Code Execution
Welcomizer WordPress plugin <= 2.8.1 contains a remote code execution caused by missing authorization checks and use of eval() in twiz_ajax_callback's 'savesection' handler, letting authenticated attackers with Subscriber-level access inject arbitrary PHP code.
- 7.2 /10 HighCVE-2026-15664 No auth
Quill Forms - Stored Cross-Site Scripting
Quill Forms WordPress plugin <= 5.7.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Multiple Choice 'Other' value, letting unauthenticated attackers inject scripts executed in admin context, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-13354 No auth
Asset CleanUp: Page Speed Booster - Stored XSS
Asset CleanUp: Page Speed Booster WordPress plugin <= 1.4.0.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers inject scripts that execute on page access, exploit requires combine_loaded_css enabled.
- 7.5 /10 HighCVE-2026-1255 No auth
YS LeadGen WordPress Plugin - Sensitive Information Exposure
YS LeadGen WordPress plugin <= 2.1.4 contains a sensitive information exposure caused by unauthenticated access to 'ysleadgen_get_captured_data' AJAX action, letting unauthenticated attackers retrieve captured form submission data including PII.
- 7.5 /10 HighCVE-2026-93872 Auth required
Cotonti - Insecure Deserialization
Cotonti 1.0.0 contains an insecure deserialization vulnerability caused by passing base64-decoded cb parameter to unserialize() without allowed_classes restriction in comments plugin EditAction, letting registered users with comment write permissions instantiate arbitrary PHP objects and potentially achieve file write or code execution.
- 8.1 /10 HighCVE-2026-93868
Cotonti - Authentication Bypass
Cotonti through 1.0.0 contains a broken authentication caused by predictable password recovery tokens derived from md5(microtime()) in users.passrecover.php, letting unauthenticated attackers reset any account password including administrators, exploit requires attacker to read server Date header.
- 7.5 /10 HighCVE-2026-93761 No auth
Mongoid - Denial of Service
Mongoid contains a denial of service caused by inefficient regular expression complexity in the in-memory query evaluation component, letting unauthenticated attackers cause excessive processing and application unresponsiveness, exploit requires user-supplied text in pattern-matching query.
- 8.2 /10 HighCVE-2026-93760 No auth
Mongoid - NoSQL Injection
Mongoid contains a NoSQL injection caused by unrestricted query operators from caller-supplied filter data, letting unauthenticated attackers influence database queries, exploit requires forwarding of external filter parameters.
- 8.6 /10 HighCVE-2026-93759 No auth
Mongoid - NoSQL Injection
Mongoid contains a nosql injection caused by unneutralized string-typed query criteria passed as server-side JavaScript expressions, letting unauthenticated attackers execute arbitrary code on the database, exploit requires attacker to control query arguments.
- 8.1 /10 HighCVE-2026-93758 Auth required
Mongoid - Broken Access Control
Mongoid contains a broken access control caused by insecure direct object reference in nested attributes handling, letting users with basic privileges access and modify records not owned by them, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-93753 No auth
deepmerge - Prototype Pollution
deepmerge <= 4.3.1 contains a prototype pollution vulnerability caused by improper validation of keys in mergeObject() function, letting attackers inject properties into object prototypes, exploit requires attacker-controlled source objects.
- 7.5 /10 HighCVE-2026-93752 No auth
CSSOM - Denial of Service
CSSOM through 0.5.0 contains a denial of service caused by failure to validate reserved property names in CSSStyleDeclaration.setProperty(), letting attackers trigger excessive memory allocation and process termination, exploit requires crafted stylesheet with reserved property.