High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 387 of 568
- 7.6 /10 HighCVE-2026-66630 Auth required
PublishPress Series - SQL Injection
PublishPress Series <= 3.1.3 contains a SQL injection caused by improper sanitization of administrator inputs, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.
- 7.6 /10 HighCVE-2026-66628 Auth required
WP-Lister Lite for eBay - SQL Injection
WP-Lister Lite for eBay <= 3.8.11 contains a SQL injection caused by improper sanitization of user input, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 7.6 /10 HighCVE-2026-66626 Auth required
SKT Addons for Elementor - SQL Injection
SKT Addons for Elementor <= 4.0 contains a SQL injection caused by improper input sanitization in the editor component, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.
- 7.6 /10 HighCVE-2026-66625 Auth required
WC Vendors Marketplace - SQL Injection
WC Vendors Marketplace <= 2.7.2.1 contains a SQL injection caused by improper sanitization of administrator inputs, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.
- 7.6 /10 HighCVE-2026-66624 Auth required
WPMasterToolKit - SQL Injection
WPMasterToolKit <= 2.22.0 contains a SQL injection caused by improper sanitization of administrator inputs, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.
- 7.6 /10 HighCVE-2026-66619 Auth required
Newsletters - SQL Injection
Newsletters <= 4.18 contains a SQL injection caused by improper sanitization of administrator inputs, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.
- 7.6 /10 HighCVE-2026-66618 Auth required
WP Maps - SQL Injection
WP Maps <= 4.9.9 contains a SQL injection caused by improper sanitization of administrator inputs, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.
- 8.5 /10 HighCVE-2026-66580 Auth required
Contributor Product Feed Manager - SQL Injection
Contributor Product Feed Manager <= 7.12.0 contains a SQL injection caused by unsanitized input in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-66571 No auth
Asset CleanUp: Page Speed Booster - Cross Site Request Forgery
Asset CleanUp: Page Speed Booster <= 1.4.0.5 contains an unauthenticated cross site request forgery caused by lack of proper request validation, letting unauthenticated attackers perform unauthorized actions, exploit requires no authentication.
- 7.3 /10 HighCVE-2026-66269 No auth
Dell OpenManage Server Administrator - Protection Mechanism Bypass
Dell OpenManage Server Administrator < 11.1.0.3 contains an unsafe reflection vulnerability caused by use of externally-controlled input to select classes or code, letting unauthenticated remote attackers bypass protection mechanisms, exploit requires remote access.
- 7.5 /10 HighCVE-2026-63460 No auth
Vendure - Denial of Service
Vendure prior to 3.6.5 contains a denial of service caused by catastrophic backtracking in regex patterns supplied via Shop GraphQL API StringOperators.regex, letting unauthenticated attackers block request processing and make storefront and admin API unavailable, exploit requires unauthenticated access to public ShopProductsResolver.products.
- 8.7 /10 HighCVE-2026-63459 Auth required
Vendure - Stored XSS
Vendure < 3.6.5 contains a stored XSS caused by assigning administrator-controlled markup to innerHTML in RichTextDescriptionCell, letting lower-privilege administrators execute scripts when viewed by other admins, exploit requires admin privileges.
- 8.2 /10 HighCVE-2026-56795 Auth required
Dell Server Update Utility - Code Execution
Dell Server Update Utility < 26.07.01 contains an uncontrolled search path element vulnerability caused by improper path handling, letting low privileged local attackers execute code, exploit requires local access.
- 8.8 /10 HighCVE-2026-54916 No auth
NetBox Device Type Library - Remote Code Execution
NetBox Device Type Library contains a code execution vulnerability caused by module shadowing via unauthenticated contributor adding malicious files in tests directory, letting attackers execute arbitrary code on GitHub Actions runner, exploit requires ability to submit pull requests.
- 7.5 /10 HighCVE-2026-54716 No auth
Valhalla - Denial of Service
Valhalla <= 3.7.0 contains a denial of service caused by zero-area exclude_polygons with three collinear points in /sources_to_targets POST request, letting unauthenticated attackers cause unbounded memory growth and crash the worker, exploit requires crafted POST request with specific geometry.