High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 496 of 552

  • 8.8 /10 High
    CVE-2026-81941 Auth required

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a command injection caused by an authenticated non-administrative user constructing a flow with an MCP Tools component using local stdio subprocess transport, letting attackers execute arbitrary OS commands at application privilege level, exploit requires authenticated non-administrative user.

  • 8.8 /10 High
    CVE-2026-81940 Auth required

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a command injection caused by improper neutralization of special characters in flow display names, letting remote authenticated attackers execute arbitrary code.

  • 8.1 /10 High
    CVE-2026-81805 No auth

    SiteSkite - Privilege Escalation

    SiteSkite <= 2.1.5 contains a privilege escalation vulnerability allowing unauthenticated attackers to escalate privileges without authentication.

  • 7.5 /10 High
    CVE-2026-81804 No auth

    ZHBackup – Backup, Restore & Migration - Information Disclosure

    ZHBackup – Backup, Restore & Migration <= 2.4.2 contains an information disclosure vulnerability caused by unauthenticated access, letting remote attackers access sensitive data without authentication.

  • 7.5 /10 High
    CVE-2026-81803 Auth required

    RepairBuddy - Remote Code Execution

    RepairBuddy <= 4.1224 contains a remote code execution caused by unspecified vulnerability, letting remote attackers execute arbitrary code, exploit requires no special conditions.

  • 8.1 /10 High
    CVE-2026-81801 Auth required

    WP-Stateless - Broken Access Control

    WP-Stateless <= 4.4.1 contains a subscriber settings change vulnerability caused by improper handling of subscriber settings, letting attackers modify subscriber configurations, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-81799 No auth

    Return Refund and Exchange For WooCommerce - Broken Access Control

    Return Refund and Exchange For WooCommerce <= 4.6.4 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 7.3 /10 High
    CVE-2026-81796 No auth

    WP Travel - Authentication Bypass

    WP Travel <= 12.0.3 contains a broken authentication vulnerability allowing unauthenticated attackers to bypass authentication, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-81795 No auth

    Page Visits Counter - Lite - Reflected XSS

    Page Visits Counter - Lite <= 1.2.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-81794 No auth

    Shirt Product Designer for WooCommerce - Broken Access Control

    Shirt Product Designer for WooCommerce 1.0.4 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 8.6 /10 High
    CVE-2026-81789 No auth

    Advanced Product Fields Extended for WooCommerce - Unrestricted File Deletion

    Advanced Product Fields Extended for WooCommerce <= 3.1.6 contains an unrestricted file deletion vulnerability caused by improper input validation, letting unauthenticated attackers delete arbitrary files remotely, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-81786 No auth

    Thank You Page Customizer for WooCommerce - Broken Access Control

    Thank You Page Customizer for WooCommerce <= 1.2.2 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 8.1 /10 High
    CVE-2026-81784 No auth

    Wise Chat - Insecure Deserialization

    Wise Chat <= 3.4 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-81783 Auth required

    MailMunch - Authentication Bypass

    MailMunch <= 3.2.5 contains a broken authentication vulnerability in Subscriber component, letting attackers bypass authentication mechanisms, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-81554 Auth required

    IBM DataStage on Cloud Pak for Data - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an absolute path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers obtain sensitive information.