High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 513 of 552
- 8.1 /10 HighCVE-2026-18147 No auth
FreeIPA - Stored XSS
FreeIPA contains a stored XSS caused by DOM manipulation in the Web UI password reset page, letting unauthenticated remote attackers execute arbitrary JavaScript via crafted links, exploit requires victim interaction.
- 7.2 /10 HighCVE-2026-17553 Auth required
WP EasyCart - Privilege Escalation
WP EasyCart <= 5.9.3 contains a privilege escalation caused by insecure update_option() calls in ec_ajax_save_page_default_options() AJAX handler, letting authenticated Store Manager-level users escalate to administrator by modifying WordPress options, exploit requires authenticated user with Store Manager or higher privileges.
- 7.5 /10 HighCVE-2026-16960 No auth
Loops & Logic WordPress - Information Disclosure
Loops & Logic WordPress plugin < 4.3.0 contains an information disclosure vulnerability caused by insufficient restriction on public template-data action, letting unauthenticated users read arbitrary user records and site options, exploit requires no authentication.
- 7.7 /10 HighCVE-2026-15913 Auth required
Fortra GoAnywhere MFT - Path Traversal
Fortra GoAnywhere MFT < 7.10.2 contains a path traversal caused by improper validation in /attachRemoteFiles endpoint, letting web users with Secure Folders and Secure Mail permissions read arbitrary files outside their sandbox, exploit requires specific permissions.
- 7.5 /10 HighCVE-2026-15667 PoC publicAuth required
Eventin WordPress Plugin - Local File Inclusion
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated contributors execute arbitrary PHP code, exploit requires contributor-level access.
- 7.5 /10 HighCVE-2026-15406 Auth required
Eventin WordPress Plugin - Local File Inclusion
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated attackers with custom-level access include and execute arbitrary PHP files, exploit requires authenticated user with custom-level access or higher.
- 7.2 /10 HighCVE-2026-14989 No auth
WPLP Cookie Consent - Stored XSS
WPLP Cookie Consent plugin for WordPress <= 4.4.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'wpl_user_preference' parameter, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires no authentication.
- 8.6 /10 HighCVE-2026-14962 PoC publicNo auth
ELEX WooCommerce Request a Quote - SQL Injection
ELEX WooCommerce Request a Quote WordPress plugin < 2.4.1 contains a SQL injection caused by improper sanitization and escaping of a parameter in a SQL query, letting unauthenticated attackers extract arbitrary data from the database.
- 8.8 /10 HighCVE-2026-14359 CISA KEVAuth required
YITH WooCommerce Waitlist Premium - Privilege Escalation
YITH WooCommerce Waitlist Premium <= 3.35.0 contains a privilege escalation caused by missing capability check and nonce verification in add_user_in_waiting_list() function, letting authenticated attackers with Subscriber-level access create admin users.
- 7.2 /10 HighCVE-2026-13359 No auth
BestWebSoft Contact Form to DB - Stored XSS
BestWebSoft Contact Form to DB plugin for WordPress <= 1.7.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in cntctfrm_contact_dropdown parameter, letting unauthenticated attackers execute scripts in administrator sessions via message manager page, exploit requires unauthenticated contact form submission.
- 8.2 /10 HighCVE-2026-12855 Auth required
HP Projects - Buffer Overflow
HP projects contain a buffer overflow caused by unvalidated memory boundaries in custom code, letting attackers execute arbitrary code remotely, exploit requires no special privileges.
- 7.5 /10 HighCVE-2024-58382 No auth
league/commonmark - Denial of Service
league/commonmark < 2.6.0 contains a denial of service caused by polynomial time complexity in Markdown parsing, letting attackers exhaust CPU and PHP-FPM resources, exploit requires crafted Markdown inputs.
- 7.5 /10 HighCVE-2024-58381 No auth
PocketMine-MP - Denial of Service
PocketMine-MP < 5.11.1 contains a denial of service vulnerability caused by improper object initialization from scalar JSON types in LoginPacket JSON processing, letting remote attackers crash the server by sending malformed JSON data.
- 7.5 /10 HighCVE-2023-54393 No auth
PocketMine-MP - Denial of Service
PocketMine-MP < 4.20.5 contains a denial of service vulnerability caused by improper validation in JsonMapper during LoginPacket JSON parsing, letting attackers crash the server by sending malformed JSON structures, exploit requires network access.
- 7.5 /10 HighCVE-2023-54390 No auth
PocketMine-MP - Denial of Service
PocketMine-MP < 5.3.1 and < 4.23.1 contain a denial of service vulnerability caused by improper null value handling in LoginPacket JSON parsing, letting attackers crash the server by sending malformed JSON with unexpected null elements.