High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 384 of 568
- 8.8 /10 HighCVE-2026-88792 No auth
Dictionary WordPress plugin - Stored XSS
Dictionary WordPress plugin through 1.0 contains a stored XSS caused by lack of authorization, sanitization, and escaping when adding or updating dictionary entries, letting unauthenticated attackers execute arbitrary scripts when viewing entries.
- 8.6 /10 HighCVE-2026-87963 No auth
Yo WordPress - SQL Injection
Yo WordPress plugin 1.1 through 1.3.1 contains a sql injection caused by unsanitized username request parameter in SQL query, letting unauthenticated attackers read arbitrary database contents including admin password hashes, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-87935 No auth
WordPress Paid Downloads - Unrestricted File Upload
WordPress Paid Downloads plugin <= 3.15 contains an unrestricted file upload vulnerability caused by missing authorization and file type validation in admin_request_handler, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires unauthenticated access to admin-post.php with is_admin() true.
- 7.8 /10 HighCVE-2026-87886 CISA KEVAuth required
Acronis Backup - Privilege Escalation
Acronis Backup plugins for cPanel & WHM, Plesk, and DirectAdmin on Linux before specified builds contain a local privilege escalation caused by insecure file permissions, letting local attackers escalate privileges, exploit requires local access.
- 8.8 /10 HighCVE-2026-87786 No auth
Dewa Kirim WordPress - Stored XSS
Dewa Kirim WordPress plugin through 1.0.0 contains a stored XSS caused by unescaped delivery coordinates in inline scripts, letting unauthenticated users execute JavaScript in administrator sessions, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-87742 No auth
quarkus-websockets-next - Denial of Service
quarkus-websockets-next contains a denial of service caused by unbounded message buffering and lack of read backpressure, letting remote attackers exhaust heap space and crash the JVM by streaming messages rapidly.
- 8.8 /10 HighCVE-2026-86864 Auth required
pgAdmin 4 - Command Injection
pgAdmin 4 < 9.18 contains an arbitrary file creation and connection-string injection vulnerability caused by improper validation of the 'database' field in the Backup tool's /backup/job/<sid>/object request, letting authenticated users with tools_backup permission overwrite files and redirect database connections, exploit requires authenticated user with tools_backup permission.
- 8.8 /10 HighCVE-2026-86801 No auth
To Do List Member WordPress plugin - Unrestricted File Upload
To Do List Member WordPress plugin 1.4 through 1.6 contains an unrestricted file upload caused by an unauthenticated file upload endpoint that lacks authentication and content validation, letting unauthenticated attackers upload, list, and delete files on the site.
- 7.8 /10 HighCVE-2026-86320
Flatpak-builder - Command Injection
Flatpak-builder contains a command injection caused by execution of Git post-applypatch hooks when applying patch sources with use-git-am: true, letting attackers execute arbitrary code with user privileges during build process, exploit requires attacker to provide malicious source.
- 7.1 /10 HighCVE-2026-86049
Jupyter Server - Information Disclosure
Jupyter Server < 2.21.0 contains an information disclosure vulnerability caused by improper token scrubbing of the Referer header in 5xx request logging, letting attackers with log access recover tokens, exploit requires log access.
- 7.5 /10 HighCVE-2026-86040 No auth
libp2p - Denial of Service
libp2p prior to 11.0.26 contains a denial of service caused by unauthenticated RPC frames with excessive subscription entries in floodsub, letting remote peers exhaust CPU and memory, exploit requires network access.
- 8.2 /10 HighCVE-2026-86039 No auth
libp2p @libp2p/peer-store - Broken Access Control
libp2p @libp2p/peer-store 8.0.0 to 12.0.24 contains a broken access control caused by improper verification of PeerRecord.peerId in RecordEnvelope signatures, letting attackers poison address records, exploit requires attacker to sign records with their own key.
- 7.5 /10 HighCVE-2026-86038 No auth
libp2p @libp2p/gossipsub - Authentication Bypass
libp2p @libp2p/gossipsub 15.0.0 to 16.0.5 contains an authentication bypass caused by improper signature verification binding in buildRawMessage.ts, letting unauthenticated attackers impersonate victim RSA peer IDs, exploit requires crafted message with attacker-controlled keys.
- 7.5 /10 HighCVE-2026-85917 No auth
Azure AI Foundry - Privilege Escalation
Azure AI Foundry contains a server side request forgery caused by improper request handling, letting unauthorized attackers elevate privileges over a network, exploit requires network access.
- 7.5 /10 HighCVE-2026-85721 PoC publicNo auth
AsyncHttpClient - Denial of Service
AsyncHttpClient 2.0.0 to 2.16.1 and 3.0.8 to 3.0.12 contains a denial of service caused by unbounded HTTP response decompression in Http1ContentDecompressor and HTTP/2 decompressor, letting attackers exhaust client heap memory, exploit requires attacker to send crafted compressed responses.