High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 360 of 568
- 7.5 /10 HighCVE-2026-93488 No auth
Netty - Denial of Service
Netty contains a denial of service vulnerability caused by SpdySessionHandler accepting unlimited concurrent remote-initiated streams due to localConcurrentStreams defaulting to Integer.MAX_VALUE, letting remote attackers cause JVM OutOfMemoryError, exploit requires network access.
- 7.1 /10 HighCVE-2026-93485 PoC publicNo auth
Automattic WordPress - Stored XSS
Automattic WordPress core < 7.1.1, 7.0 < 7.0.5, 6.9 < 6.9.8, 6.8 < 6.8.9, 6.7 < 6.7.8, 6.6 < 6.6.8, 6.5 < 6.5.11, 6.4 < 6.4.11, 6.3 < 6.3.11, 6.2 < 6.2.12, 6.1 < 6.1.13, 6.0 < 6.0.15, 5.9 < 5.9.17, 5.8 < 5.8.16, 5.7 < 5.7.18, 5.6 < 5.6.20, 5.5 < 5.5.21, 5.4 < 5.4.22, 5.3 < 5.3.24, 5.2 < 5.2.27, 5.1 < 5.1.25, 5.0 < 5.0.28, 4.9 < 4.9.32, 4.8 < 4.8.31, and 4.7 < 4.7.36 contain a DOM-based stored cross-site scripting caused by improper input neutralization during web page generation, letting unauthenticated attackers execute scripts via comment moderation bypass, exploit requires comment moderation disabled and bypass of comment approval.
- 7.5 /10 HighCVE-2026-93468 No auth
HGiga OAKlouds - Arbitrary File Read
HGiga OAKlouds contains an arbitrary file read caused by relative path traversal, letting unauthenticated remote attackers read arbitrary system files, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-93456 No auth
django-page-cms - Stored XSS
django-page-cms through 2.0.13 contains a stored cross-site scripting caused by exempting five admin mutation views from CSRF protection in pages/admin/views.py, letting signed-in editors store unescaped content that affects all visitors, exploit requires editor login.
- 8.3 /10 HighCVE-2026-93453 PoC publicNo auth
SOGo - Open Redirect
SOGo < 5.12.11 contains an open redirect caused by using client-supplied Origin header in password-reset links, letting unauthenticated attackers redirect recovery tokens to attacker domains, exploit requires crafted Origin header.
- 7.5 /10 HighCVE-2026-93452 No auth
snappy-java - Buffer Overflow
snappy-java through 1.1.10.8 contains a buffer overflow caused by writing past the end of the destination buffer in Snappy.compress(ByteBuffer, ByteBuffer), letting attackers corrupt off-heap memory and cause JVM termination, exploit requires supplying incompressible data exceeding buffer capacity.
- 7.5 /10 HighCVE-2026-93450 No auth
go-openapi/swag - Denial of Service
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability caused by unbounded recursion in ordered JSON parsing and serialization, letting remote unauthenticated attackers cause denial of service by submitting deeply nested JSON documents.
- 8.3 /10 HighCVE-2026-93371 No auth
marcopiovanello yt-dlp-web-ui - Command Injection
marcopiovanello yt-dlp-web-ui <= v4 contains a command injection caused by manipulation of the "params" argument in NewGenericDownload function, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-93331 No auth
GPAC - Out of Bounds Read
GPAC 26.08-DEV contains an out-of-bounds read caused by improper handling of the "size" argument in gf_rtp_parse_ttxt function of RTP Depacketizer, letting remote attackers read memory out-of-bounds, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-93031 Auth required
WP Cloud Plugins - Arbitrary File Upload
WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box for WordPress <= 3.8.3 contain an arbitrary file upload caused by missing capability checks and improper file validation in download_file_to_uploads, letting authenticated attackers with subscriber-level access upload executable files, exploit requires subscriber-level authentication.
- 7.5 /10 HighCVE-2026-92708 No auth
Svelte devalue - Information Disclosure
Svelte devalue 5.1.0 through 5.9.2 contains an information disclosure caused by serializing the entire backing ArrayBuffer of typed arrays, letting attackers access up to 64 KB of unrelated process memory during server-side rendering, exploit requires a public page returning a small Buffer.
- 7.2 /10 HighCVE-2026-92619 Auth required
Booking Calendar - Privilege Escalation
Booking Calendar WordPress plugin <= 11.8.2 contains a privilege escalation caused by improper option policy checks in handle_ajax_save() via wpbc_ajax_option_save AJAX action, letting authenticated Editors escalate to Administrator by modifying core options, exploit requires Editor-level access.
- 7.5 /10 HighCVE-2026-91149 No auth
Cockpit - Denial of Service
Cockpit contains a denial of service caused by unbounded thread creation in the cockpit-tls service, letting unauthenticated remote attackers exhaust system resources, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-91127 No auth
File Viewer - Stored XSS
File Viewer @file-viewer/doc < 2.3.1 and msdoc-viewer < 0.2.2 contain a stored XSS caused by unsafe URL schemes in legacy DOC renderer hyperlink targets, letting attackers execute scripts in the embedding application's origin, exploit requires user clicking crafted link.
- 7.1 /10 HighCVE-2026-90978 Auth required
Filter Gallery WordPress plugin - Broken Access Control
Filter Gallery WordPress plugin < 1.1.5 contains a broken access control vulnerability caused by missing nonce verification and capability checks in AJAX handlers, letting low-privileged users overwrite posts and delete stored gallery options, exploit requires low-privileged user access.