High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 37 of 725

  • 8.8 /10 High
    CVE-2026-115967 Auth required

    Hamid Alinia Login with phone number - Authentication Bypass

    Hamid Alinia Login with phone number <= 1.8.78 contains a broken authentication caused by weak authentication mechanisms, letting attackers abuse authentication, exploit requires no special conditions.

  • 8.5 /10 High
    CVE-2026-115965 Auth required

    BuddyPress - SQL Injection

    BuddyPress <= 14.5.2 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-115963 Auth required

    VideoWhisper.com Broadcast Live Video - Broken Access Control

    VideoWhisper.com Broadcast Live Video <= 7.3.9 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-11587 Auth required

    Centreon - SQL Injection

    Centreon contains a SQL injection caused by improper sanitization in ACL management, letting authenticated users read and modify the database, exploit requires authenticated access to ACL management.

  • 7.2 /10 High
    CVE-2026-115821 No auth

    NewsmanApp WordPress Plugin - Stored XSS

    NewsmanApp WordPress plugin <= 3.7.29 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'billing_first_name, billing_last_name' parameters, letting unauthenticated attackers inject scripts, exploit requires enabled Remarketing feature with non-empty Remarketing ID.

  • 7.8 /10 High
    CVE-2026-115805 Auth required

    Rapid7 Insight Agent - Privilege Escalation

    Rapid7 Insight Agent on Linux and macOS contains a privilege escalation caused by improper handling of local filesystem paths in inventory collection, letting authenticated local users gain elevated privileges, exploit requires existing local access.

  • 8.7 /10 High
    CVE-2026-115793 No auth

    P-Net - Denial of Service

    P-Net before 1.0.3 contains a denial of service caused by not releasing RPC sessions for unknown interface or object UUIDs, letting remote unauthenticated attackers exhaust sessions and disrupt service.

  • 7.5 /10 High
    CVE-2026-115713

    Elastic Cloud Enterprise - Path Traversal

    Elastic Cloud Enterprise contains a symlink attack vulnerability caused by improper link resolution before file access, letting attackers gain unauthorized read and write access to data of other deployments on the same host, exploit requires local access to the host.

  • 8.2 /10 High
    CVE-2026-115709

    Elastic Cloud Enterprise - Path Traversal

    Elastic Cloud Enterprise contains a symlink attack vulnerability caused by improper link resolution before file access, letting attackers disclose and lose data of other deployments on the same host, exploit requires local access.

  • 7.2 /10 High
    CVE-2026-115708

    Elastic Cloud Enterprise - Authentication Bypass

    Elastic Cloud Enterprise contains an authentication bypass caused by improper link resolution before file access (link following), letting attackers perform unauthorized configuration changes via symlink attack, exploit requires access to the host.

  • 7.1 /10 High
    CVE-2026-115611 No auth

    PluginUs.Net TableOn - Reflected XSS

    PluginUs.Net TableOn <= 1.0.7 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-115599 No auth

    ThimPress LearnPress - Broken Access Control

    ThimPress LearnPress <= 4.4.11 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit unauthorized access, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-115592 No auth

    OceanWP OceanWP - Reflected XSS

    OceanWP OceanWP <= 4.2.7 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-114193 No auth

    Eyal Fitoussi GEO my WordPress - Broken Access Control

    Eyal Fitoussi GEO my WordPress <= 4.5.5.5 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.

  • 7.8 /10 High
    CVE-2026-114148 PoC publicAuth required

    ASP.NET Core - Privilege Escalation

    ASP.NET Core contains a privilege escalation caused by incorrect default permissions, letting authorized attackers elevate privileges locally, exploit requires attacker to be authorized.