High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 361 of 568

  • 8.1 /10 High
    CVE-2026-89413 Auth required

    Filter Gallery WordPress Plugin - Authorization Bypass

    Filter Gallery WordPress plugin <= 1.1.4 contains an authorization bypass caused by improper user authorization verification, letting authenticated attackers with subscriber-level access delete arbitrary gallery records, exploit requires omission of nonce POST field.

  • 7.5 /10 High
    CVE-2026-89059 No auth

    RESTEasy - Denial of Service

    RESTEasy contains a denial of service caused by lack of limits on declared image dimensions in IIOImageProvider, letting remote unauthenticated attackers exhaust JVM heap via crafted images.

  • 7.4 /10 High
    CVE-2026-89058 No auth

    RESTEasy - CORS Misconfiguration

    RESTEasy CorsFilter contains a CORS misconfiguration caused by reflecting the Origin header with Access-Control-Allow-Credentials set to true when allowing all origins, letting attackers perform credentialed cross-origin requests and read authenticated responses, exploit requires permissive CORS configuration.

  • 8.8 /10 High
    CVE-2026-88825 No auth

    iGMS Direct Booking WordPress plugin - Stored XSS

    iGMS Direct Booking WordPress plugin < 2.0 contains a stored XSS caused by lack of authorization and escaping in widget appearance settings, letting unauthenticated attackers execute scripts in admin and visitor browsers, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-88623 No auth

    NUUO Network Video Recorder - Arbitrary File Read

    NUUO Network Video Recorder 2.0.0 contains an arbitrary file read vulnerability caused by improper handling of the url parameter in up.php, letting remote attackers read arbitrary files without authentication.

  • 8.8 /10 High
    CVE-2026-88622 No auth

    NUUO Network Video Recorder - Command Injection

    NUUO Network Video Recorder 2.0.0 contains a command injection caused by improper input handling in handle_import_privilege.php, letting attackers execute arbitrary commands remotely, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-88259

    CareCam CM2507 - Authentication Bypass

    CareCam CM2507 IP cameras contain an authentication bypass caused by lack of authentication on the network video streaming service, letting unauthenticated attackers with network access retrieve live video streams, exploit requires network access to the device.

  • 8.1 /10 High
    CVE-2026-88097 No auth

    Microsoft Edge - Privilege Escalation

    Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows unauthorized local attackers to elevate privileges by exploiting memory management flaws.

  • 7.2 /10 High
    CVE-2026-87915 PoC publicNo auth

    Popup Maker - Stored Cross-Site Scripting

    Popup Maker WordPress plugin <= 1.24.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in values[Name] parameter, letting unauthenticated attackers inject scripts executed on user page access.

  • 8.6 /10 High
    CVE-2026-87775 No auth

    Tz Weekly Radio Schedule WordPress plugin - SQL Injection

    Tz Weekly Radio Schedule WordPress plugin through 1.8.1 contains a SQL injection caused by unsanitized and unescaped parameter in an AJAX action, letting unauthenticated attackers extract sensitive data from the database, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-87774 No auth

    Tz Weekly Radio Schedule WordPress plugin - SQL Injection

    Tz Weekly Radio Schedule WordPress plugin <= 1.8.1 contains a SQL injection caused by unsanitized and unescaped parameter in an AJAX action, letting unauthenticated attackers extract sensitive data from the database, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-87771 No auth

    Question and Answer WordPress plugin - SQL Injection

    Question and Answer WordPress plugin through 1.1.0 contains a sql injection caused by unsanitized and unescaped parameters in AJAX actions, letting unauthenticated attackers extract sensitive data from the database, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-87770 No auth

    Price Drop Alert for Woo Commerce WordPress plugin - SQL Injection

    Price Drop Alert for Woo Commerce WordPress plugin <= 1.1 contains a SQL injection caused by unsanitized and unescaped parameters in an AJAX action, letting unauthenticated attackers extract sensitive data from the database, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-87767 No auth

    wp shortcut link and advertisement baner WordPress plugin - SQL Injection

    wp shortcut link and advertisement baner WordPress plugin <= 1.2.0 contains a SQL injection caused by unsanitized and unescaped parameter in an AJAX action, letting unauthenticated attackers extract sensitive data from the database.

  • 7.5 /10 High
    CVE-2026-87743 No auth

    Quarkus HTTP - Authorization Bypass

    Quarkus HTTP security contains an authorization bypass caused by path normalization discrepancy between security matcher and HTTP request dispatchers, letting unauthenticated attackers access protected endpoints, exploit requires crafted URL.