High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 489 of 552
- 7.5 /10 HighCVE-2026-50013 No auth
Hoverfly - Denial of Service
Hoverfly < 1.12.8 contains a denial of service caused by unsynchronized concurrent writes to the shared responsesDiff map in Diff mode, letting attackers crash the process by sending multiple simultaneous requests.
- 7.5 /10 HighCVE-2026-49846 No auth
libks - Path Traversal
libks < 2.0.11 contains a path traversal vulnerability caused by improper URI canonicalization in clean_uri() allowing embedded ".." sequences to bypass checks, letting attackers access arbitrary filesystem paths, exploit requires crafted URI with excessive path segments.
- 8.1 /10 HighCVE-2026-49464 Auth required
NL Portal Backend Libraries nl.nl-portal:taak - Broken Access Control
NL Portal Backend Libraries nl.nl-portal:taak 1.5.0 through 3.0.0 contains a broken access control vulnerability caused by failure to verify ownership in submitTaakV2 GraphQL mutation, letting authenticated users read, overwrite, and complete other users' tasks, exploit requires authentication.
- 8.1 /10 HighCVE-2026-38058 Auth required
iDirect iQ200 VSAT terminal - Authentication Bypass
iDirect iQ200 VSAT terminal contains an information disclosure vulnerability caused by returning complete device configuration including MD5-crypt password hashes in the SECURITY section, letting authenticated users extract and crack password hashes offline, exploit requires valid web credentials.
- 8.8 /10 HighCVE-2026-38056 Auth required
iDirect iQ200 - Privilege Escalation
iDirect iQ200 VSAT terminal firmware 23.0.1.0 contains a local privilege escalation caused by insufficient privilege restrictions on a pre-configured low-privilege local user account, letting local attackers gain administrative control, exploit requires access to the built-in low-privilege account.
- 8.1 /10 HighCVE-2026-19991 Auth required
UsersWP WordPress Plugin - Arbitrary File Deletion
UsersWP WordPress plugin <= 1.2.70 contains an arbitrary file deletion vulnerability caused by improper validation and normalization of file paths in upload_file_remove() AJAX handler, letting authenticated subscribers delete arbitrary files.
- 7.2 /10 HighCVE-2026-18579 No auth
WP Photo Album Plus - Stored XSS
WP Photo Album Plus for WordPress <= 9.2.08.003 contains a stored cross-site scripting caused by insufficient sanitization of 'HTTP_X_FORWARDED_FOR' parameter, letting unauthenticated attackers inject scripts executed on user page access.
- 7.5 /10 HighCVE-2026-18561 No auth
Unlimited Elements For Elementor - SQL Injection
Unlimited Elements For Elementor for WordPress <= 2.0.16 contains a SQL injection caused by insufficient escaping of the 'addontype' parameter in getWhereString(), letting unauthenticated attackers extract sensitive database information, exploit requires crafted array input.
- 7.2 /10 HighCVE-2026-17037 No auth
Kirki Freeform Page Builder - Stored XSS
Kirki Freeform Page Builder plugin for WordPress <= 6.2.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject and execute arbitrary scripts when users access the page.
- 7.5 /10 HighCVE-2026-15462 No auth
Sticky Chat Widget WordPress - SQL Injection
Sticky Chat Widget WordPress plugin <= 1.4.2 contains a SQL injection caused by unsanitized 'scw_form_fields' parameter array keys in 'scw_save_form_data' AJAX action, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.
- 7.3 /10 HighCVE-2025-15679
BMC - Authentication Bypass
BMC contains a broken authentication caused by the root account being activated without a password after a factory reset, letting attackers gain unauthorized access, exploit requires factory reset operation.
- 7.5 /10 HighCVE-2026-9166 No auth
GIS Informatics GisLab Laboratory Management System - Path Traversal
GIS Informatics GisLab Laboratory Management System >= 1.4.03 < 1.5 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting attackers access unauthorized files, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-89087 No auth
OCaml cstruct - Out of Bounds Read
OCaml cstruct before 6.3.0 contains an out of bounds read caused by mishandling indexes, letting attackers potentially cause denial of service or information disclosure, exploit requires crafted input.
- 8.2 /10 HighCVE-2026-89054 No auth
OpenNMS Horizon - Broken Access Control
OpenNMS Horizon contains a missing authorization vulnerability caused by lack of authorization enforcement on PATCH endpoints in /api/v2 REST API, letting unauthenticated attackers disable event and SNMP data collection, exploit requires attacker to access the web UI.
- 8.2 /10 HighCVE-2026-89046 No auth
zstd-jni - Out of Bounds Read
zstd-jni 1.5.5-6 through 1.5.7-13 contains an out-of-bounds read caused by lack of validation of negative srcPosition arguments in Zstd.getFrameContentSize, letting attackers cause information disclosure or JVM crashes, exploit requires crafted input with negative offset.