High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 41 of 725
- 7.2 /10 HighCVE-2026-97019 No auth
AMP for WP - Stored XSS
AMP for WP – Accelerated Mobile Pages plugin for WordPress <= 1.1.17 contains a stored cross-site scripting caused by insufficient input sanitization in 'headline-*' shortcode attribute, letting unauthenticated attackers inject scripts executed on page access, exploit requires subscriber-level user to store malicious shortcode.
- 8.0 /10 HighCVE-2026-93851 Auth required
Mattermost - Stored XSS & Remote Code Execution
Mattermost 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 contain a stored XSS caused by failure to validate target post ID in Agents plugin's mention reminder, letting authenticated users cause admin browsers to send unintended API requests leading to plugin replacement and server code execution, exploit requires admin interaction.
- 7.8 /10 HighCVE-2026-93523 Auth required
X.Org X Server - Buffer Overflow
X.Org X Server < 21.1.15 and XWayland < 24.1.14 contain a heap buffer overflow caused by an out-of-range modifier value in XIPassiveUngrabDevice request, letting authenticated X clients crash or execute code in X server context.
- 7.8 /10 HighCVE-2026-93522 Auth required
X.Org X Server - Buffer Overflow
X.Org X Server < 21.1.15 and XWayland < 24.1.14 contain a heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path, letting authenticated X clients crash or execute code in the X server context, exploit requires authenticated X client.
- 7.8 /10 HighCVE-2026-93521 Auth required
X.Org X Server - Buffer Overflow
X.Org X Server < 2.1.25 and XWayland < 24.4.14 contain a buffer overflow caused by improper handling of ChangeProviderProperty requests in RandR, letting authenticated X clients crash or execute code within the server context, exploit requires authenticated X client.
- 7.8 /10 HighCVE-2026-93520 Auth required
X.org X server & XWayland - Buffer Overflow
X.org X server < 2.1.25 and XWayland < 24.1.14 contain a heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange, letting authenticated X clients crash or execute code in server context.
- 7.8 /10 HighCVE-2026-93519 Auth required
X.Org X server & XWayland - Buffer Overflow
X.Org X server < 21.1.25 and XWayland < 24.1.14 contain a buffer overflow caused by improper handling of pointer barriers in the XFIXES extension, letting authenticated X clients cause crashes or execute code, exploit requires authenticated client.
- 7.8 /10 HighCVE-2026-93518 Auth required
X.org X server - Integer Overflow
X.org X server < 21.1.25 and XWayland < 24.1.14 contain an integer truncation vulnerability in XkbResizeKeyType() causing heap buffer overflow, letting authenticated X clients cause crashes or execute code, exploit requires authentication.
- 8.5 /10 HighCVE-2026-93517 Auth required
X.org X server - Buffer Overflow
X.org X server < 21.1.25 and XWayland < 24.1.14 contain a heap buffer overflow caused by improper handling of GLX RenderLarge request where dataBytes exceeds cmdlen, letting authenticated X clients cause crashes or execute code.
- 8.8 /10 HighCVE-2026-92797 No auth
MemberPress WordPress Plugin - Cross-Site Request Forgery
MemberPress WordPress plugin <= 1.14.1 contains a cross-site request forgery caused by bypassable nonce verification in save_profile_fields(), letting unauthenticated attackers change user email via forged requests, exploit requires user interaction.
- 7.7 /10 HighCVE-2026-88967 Auth required
Grafana - Server Side Request Forgery
Grafana contains a server-side request forgery caused by user-controlled queries to Azure Monitor data source, letting users with query access cause requests to attacker endpoints and disclose Azure access tokens, exploit requires query access.
- 7.4 /10 HighCVE-2026-87103 No auth
Acronis Cyber Protect 17 - Authentication Bypass
Acronis Cyber Protect 17 < 42587 contains an improper token validation vulnerability causing sensitive information disclosure and data manipulation, letting attackers access and modify data, exploit requires crafted token.
- 7.4 /10 HighCVE-2026-87102 No auth
Acronis Cyber Protect 17 - Broken Authentication
Acronis Cyber Protect 17 < 42587 contains an improper token validation vulnerability in authentication, letting attackers disclose and manipulate sensitive information, exploit requires crafted token.
- 7.2 /10 HighCVE-2026-86399 Auth required
Dell PowerProtect Data Domain - Command Injection
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands.
- 8.8 /10 HighCVE-2026-86398 Auth required
Dell PowerProtect Data Domain - Path Traversal
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain a path traversal vulnerability caused by improper limitation of pathname to restricted directories, letting low privileged remote attackers access filesystem paths, exploit requires remote access with low privileges.