High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 36 of 725

  • 7.2 /10 High
    CVE-2026-118078 Auth required

    Shop Manager - PHP Object Injection

    Shop Manager PHP Object Injection in Product Catalog Feed <= 3.1.4 contains a PHP object injection vulnerability caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-118077 Auth required

    Sastra Essential Addons for Elementor - PHP Object Injection

    Sastra Essential Addons for Elementor <= 1.2.3 contains a PHP object injection caused by unsafe deserialization, letting attackers execute arbitrary code, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-118076 Auth required

    Frisbii Pay - PHP Object Injection

    Frisbii Pay <= 1.8.19 contains a PHP Object Injection caused by unsafe unserialization, letting attackers inject arbitrary objects to manipulate application behavior, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-118075 Auth required

    WP Media folders - PHP Object Injection

    WP Media folders <= 1.1.10 contain a PHP object injection caused by unsafe deserialization, letting contributor attackers execute arbitrary code, exploit requires contributor privileges.

  • 7.2 /10 High
    CVE-2026-118074 Auth required

    Shop Manager Finale Lite - PHP Object Injection

    Shop Manager Finale Lite <= 2.21.0 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-118073 Auth required

    News Kit Elementor Addons - PHP Object Injection

    News Kit Elementor Addons <= 1.5.0 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-117611 No auth

    Checkmk - Improper Certificate Validation

    Checkmk < 2.5.0p18, < 2.4.0p39, < 2.3.0p52, and 2.2.0 contain an improper certificate validation caused by inclusion of a root CA trusting eMudhra intermediate certificates with public private keys, letting attackers bypass TLS validation, exploit requires use of affected certificate bundles.

  • 7.2 /10 High
    CVE-2026-116869 Auth required

    Shop manager myPOS Checkout - PHP Object Injection

    Shop manager myPOS Checkout <= 1.4.5 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-116868 Auth required

    BuddyPress Xprofile Custom Field Types - PHP Object Injection

    BuddyPress Xprofile Custom Field Types <= 1.3.1 contains a PHP object injection caused by improper handling of user input, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-116867 Auth required

    Dynamic QR Code generator - PHP Object Injection

    Contributor PHP Object Injection in Dynamic QR Code generator <= 1.0.1 contains a PHP object injection vulnerability caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-116866 Auth required

    Extra Fees Plugin for WooCommerce - PHP Object Injection

    Extra Fees Plugin for WooCommerce <= 4.4.0 contains a PHP Object Injection caused by unsafe unserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-116865 Auth required

    Zippy - PHP Object Injection

    Zippy <= 1.7.0 contains a PHP object injection caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-116864 Auth required

    WPCargo Track & Trace - Object Injection

    WPCargo Track & Trace <= 8.0.5 contains an object injection vulnerability caused by unsafe handling of user input, letting attackers execute arbitrary code or manipulate data, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-116409 No auth

    WP Swings Upsell Order Bump Offer for WooCommerce - Reflected XSS

    WP Swings Upsell Order Bump Offer for WooCommerce <= 3.1.6 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-116399 No auth

    InstaWP InstaWP Connect - Cross Site Request Forgery

    InstaWP InstaWP Connect <= 0.1.4.2 contains a cross site request forgery vulnerability caused by insufficient request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.