High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 469 of 552
- 7.5 /10 HighCVE-2026-90559 No auth
snappy-java - Buffer Overflow
snappy-java through 1.1.10.8 contains a buffer overflow caused by lack of validation of destination buffer capacity in Snappy.uncompress(ByteBuffer, ByteBuffer), letting attackers cause JVM termination by writing past buffer boundaries, exploit requires crafted compressed data.
- 7.8 /10 HighCVE-2026-90556 No auth
Freeciv - Buffer Overflow
Freeciv < 3.2.6 contains a heap buffer overflow caused by processing savegame files with worklist lengths exceeding array bounds in worklist_load(), letting attackers corrupt memory when loading crafted savegame files, exploit requires loading malicious savegame.
- 7.8 /10 HighCVE-2026-90553 No auth
vLLM - Remote Code Execution
vLLM < 0.28.0 contains a remote code execution caused by ignoring the trust_remote_code parameter in LlavaOnevision2 processor loader, letting attackers execute arbitrary code with vLLM process authority, exploit requires crafted malicious model.
- 8.2 /10 HighCVE-2026-90537 No auth
WWBN AVideo - Broken Access Control
WWBN AVideo contains a missing authorization vulnerability caused by insufficient access control in plugin/Scheduler/sendEmail.json.php, letting unauthenticated attackers enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by providing a valid site-wide daily token.
- 7.5 /10 HighCVE-2026-90535 PoC public
Flowise - Denial of Service
Flowise < 3.1.4 contains an unauthenticated denial of service vulnerability caused by lack of ownership verification in /api/v1/text-to-speech/abort endpoint, letting attackers terminate active chatflow predictions, exploit requires known chatflow and chat identifiers.
- 8.2 /10 HighCVE-2026-89266 No auth
stb_vorbis - Buffer Overflow
stb_vorbis through 1.22 contains a buffer overflow caused by truncation of codebook multiplicands allocation size from size_t to int in start_decoder(), letting attackers trigger heap corruption or crashes via crafted Ogg Vorbis files, exploit requires crafted file.
- 8.0 /10 HighCVE-2026-87888 Auth required
YayPricing WordPress plugin - Stored XSS
YayPricing WordPress plugin < 3.5.7 contains a stored XSS caused by missing authorization check on a REST route saving pricing rules, letting users with subscriber role store JavaScript executing in admin's browser, exploit requires subscriber role or higher.
- 7.5 /10 HighCVE-2026-87842 No auth
Zonify WordPress - Authentication Bypass
Zonify WordPress plugin < 1.0.5 contains an authentication bypass caused by missing capability and authentication checks before returning stored account login token, letting unauthenticated attackers retrieve and use the token.
- 8.8 /10 HighCVE-2026-87759 Auth required
Add User Autocomplete WordPress plugin - Broken Access Control
Add User Autocomplete WordPress plugin < 1.2 contains a broken access control vulnerability caused by lack of capability and nonce checks in site-membership invitation creation, letting authenticated users escalate privileges to administrator on multisite installations, exploit requires authentication.
- 7.5 /10 HighCVE-2026-85200 No auth
GEO my WP - Local File Inclusion
GEO my WP WordPress plugin <= 4.5.5.3 contains a local file inclusion caused by improper handling in gmw_posts_locator_ajax_info_window_loader function, letting unauthenticated attackers execute arbitrary PHP code remotely.
- 8.1 /10 HighCVE-2026-84099 No auth
wpstorecart WordPress Plugin - Insecure Deserialization
wpstorecart WordPress plugin through 5.0.7 contains an insecure deserialization vulnerability caused by direct unauthenticated access to a bundled add-on that deserializes user input without class restrictions, letting unauthenticated attackers inject arbitrary PHP objects, exploit requires no authentication.
- 8.6 /10 HighCVE-2026-84047 No auth
Album Cover Finder WordPress - SQL Injection
Album Cover Finder WordPress plugin <= 0.7.0 contains a sql injection caused by improper sanitization and escaping of a parameter in SQL query, letting unauthenticated attackers execute arbitrary SQL commands remotely.
- 8.8 /10 HighCVE-2026-81742 No auth
BE REST Endpoints WordPress - Stored XSS
BE REST Endpoints WordPress plugin through 1.0.0 contains a stored XSS caused by lack of authorization and input sanitization in widget operations, letting unauthenticated attackers execute arbitrary scripts in users' browsers.
- 7.1 /10 HighCVE-2026-81429 No auth
WPBakery Page Builder - Stored XSS
WPBakery Page Builder WordPress plugin <= 1.0.2 contains a stored cross-site scripting caused by lack of CSRF check and unsanitized template-import data, letting attackers execute script in administrator session via forged request.
- 7.2 /10 HighCVE-2026-81090 Auth required
Gpx2Graphics WordPress Plugin - Cross Site Request Forgery & Remote Code Execution
Gpx2Graphics WordPress plugin through 0.3 contains a cross site request forgery vulnerability caused by lack of CSRF check and file type validation in file upload handling, letting logged-in administrators upload arbitrary files leading to remote code execution.