High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 470 of 552
- 8.6 /10 HighCVE-2026-80494 No auth
Yogeta WP Cloud WordPress - Path Traversal
Yogeta WP Cloud WordPress plugin through 1.0 contains a path traversal caused by lack of validation of user-supplied file path in a public endpoint, letting unauthenticated attackers download arbitrary files including sensitive credentials.
- 8.6 /10 HighCVE-2026-80491 No auth
SAMO Forms WordPress - SQL Injection
SAMO Forms WordPress plugin through 1.0.0 contains a SQL injection caused by improper sanitization and escaping of user input in several unauthenticated actions, letting unauthenticated attackers execute arbitrary SQL queries.
- 8.8 /10 HighCVE-2026-78175 CISA KEVAuth required
Tutor LMS - Remote Code Execution
Tutor LMS WordPress plugin <= 4.0.7 contains a PHP Object Injection caused by improper handling of the withdraw_method_field parameter in tutor_save_withdraw_account AJAX handler, letting authenticated attackers with subscriber access or higher achieve remote code execution, exploit requires monetization feature enabled and user registration allowed.
- 7.2 /10 HighCVE-2026-77752 Auth required
Temporary Login Without Password WordPress - Broken Access Control
Temporary Login Without Password WordPress plugin < 1.9.9 contains a broken access control caused by missing verification of network super admin rights, letting site administrators escalate privileges to network super admin, exploit requires attacker to be a site administrator.
- 7.2 /10 HighCVE-2026-77705 Auth required
Booking for Appointments and Events Calendar WordPress plugin - Broken Access Control
Booking for Appointments and Events Calendar WordPress plugin < 2.4.10 contains a broken access control vulnerability caused by lack of verification on user entitlement when editing linked WordPress accounts, letting users with customer or employee management permissions modify other users' passwords and emails to take over accounts, exploit requires user to have customer or employee management permissions.
- 7.5 /10 HighCVE-2026-16482 No auth
rtMedia for WordPress - SQL Injection
rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 contains a time-based blind SQL Injection caused by insufficient escaping of the 'compare' parameter in SQL queries, letting unauthenticated attackers extract sensitive database information, exploit requires a public page with rtMedia shortcode and crafted rtmedia_shortcode GET parameter.
- 8.8 /10 HighCVE-2026-15451 Auth required
MemberPress Corporate Accounts - Privilege Escalation
MemberPress Corporate Accounts WordPress plugin <= 1.5.39 contains a privilege escalation caused by mass assignment in 'add_sub_account_user' passing unfiltered 'userdata' to 'wp_insert_user', letting authenticated corporate account users escalate privileges, exploit requires subscriber-level access or higher.
- 7.6 /10 HighCVE-2026-90460 Auth required
OpenStack Keystone - Broken Access Control
OpenStack Keystone < 29.0.3 contains a broken access control vulnerability caused by delegated authentication tokens not being properly restricted in /v3/credentials API, letting attackers create, modify, delete credentials and read sensitive secrets, exploit requires use of delegated authentication tokens.
- 8.1 /10 HighCVE-2026-90456 No auth
Inventory-Management Component - Authentication Bypass
An inventory-management component contains a broken authentication caused by a fixed, publicly-known administrative password in the example environment-configuration file, letting attackers access the administrative interface, exploit requires deployment without running setup routine.
- 8.8 /10 HighCVE-2026-90444 Auth required
Generic File-Transfer Interface - Command Injection
A file-transfer interface requiring valid credentials contains a command injection caused by insufficient sanitization of attacker-controlled filenames, letting authenticated attackers execute arbitrary OS commands with process privileges.
- 7.8 /10 HighCVE-2026-89771 Auth required
Linux Kernel - Race Condition
Linux kernel contains a race condition in ring buffer subbuffer resizing caused by concurrent access to trace_buffer subbuf_size, letting attackers cause data corruption or denial of service, exploit requires concurrent ring buffer access.
- 7.4 /10 HighCVE-2026-89769 No auth
Linux kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by an IRQ leak on cpuhp_setup_state error path in clocksource/drivers/nxp-pit, letting attackers potentially trigger use-after-free via IRQ firing, exploit requires kernel IRQ handling.
- 7.8 /10 HighCVE-2026-89767 Auth required
Linux Kernel overlayfs - Denial of Service
Linux kernel overlayfs contains a double end_creating() call caused by casefold-mismatch in ovl_create_real(), letting unprivileged users cause a deadlock by unlocking a lock twice during directory creation, exploit requires unprivileged user access.
- 7.8 /10 HighCVE-2026-89764
Linux Kernel - Use After Free
Linux kernel contains a use-after-free caused by a race condition between concurrent revokers in rust devres component, letting attackers cause memory corruption, exploit requires concurrent revocation attempts.
- 7.8 /10 HighCVE-2026-89763 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by improper TPM teardown ordering in trusted_tpm_exit(), letting local attackers cause memory corruption or kernel crash, exploit requires local code execution.