High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 572 of 628

  • 8.1 /10 High
    CVE-2026-81801 Auth required

    WP-Stateless - Broken Access Control

    WP-Stateless <= 4.4.1 contains a subscriber settings change vulnerability caused by improper handling of subscriber settings, letting attackers modify subscriber configurations, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-81799 No auth

    Return Refund and Exchange For WooCommerce - Broken Access Control

    Return Refund and Exchange For WooCommerce <= 4.6.4 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 7.3 /10 High
    CVE-2026-81796 No auth

    WP Travel - Authentication Bypass

    WP Travel <= 12.0.3 contains a broken authentication vulnerability allowing unauthenticated attackers to bypass authentication, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-81795 No auth

    Page Visits Counter - Lite - Reflected XSS

    Page Visits Counter - Lite <= 1.2.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-81794 No auth

    Shirt Product Designer for WooCommerce - Broken Access Control

    Shirt Product Designer for WooCommerce 1.0.4 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 8.6 /10 High
    CVE-2026-81789 No auth

    Advanced Product Fields Extended for WooCommerce - Unrestricted File Deletion

    Advanced Product Fields Extended for WooCommerce <= 3.1.6 contains an unrestricted file deletion vulnerability caused by improper input validation, letting unauthenticated attackers delete arbitrary files remotely, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-81786 No auth

    Thank You Page Customizer for WooCommerce - Broken Access Control

    Thank You Page Customizer for WooCommerce <= 1.2.2 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 8.1 /10 High
    CVE-2026-81784 No auth

    Wise Chat - Insecure Deserialization

    Wise Chat <= 3.4 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-81783 Auth required

    MailMunch - Authentication Bypass

    MailMunch <= 3.2.5 contains a broken authentication vulnerability in Subscriber component, letting attackers bypass authentication mechanisms, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-81554 Auth required

    IBM DataStage on Cloud Pak for Data - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an absolute path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers obtain sensitive information.

  • 8.8 /10 High
    CVE-2026-81551 Auth required

    IBM DataStage - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers write or delete files on shared storage.

  • 8.8 /10 High
    CVE-2026-81550 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.5 /10 High
    CVE-2026-81540 Auth required

    IBM DataStage - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal caused by improper validation of file paths, letting remote authenticated attackers overwrite ruleset files of other tenants.

  • 7.2 /10 High
    CVE-2026-81431 Auth required

    WooCommerce WordPress plugin - Broken Access Control

    WooCommerce WordPress plugin < 1.1.3 contains a broken access control vulnerability caused by improper validation of registration forms, letting users with post creation privileges register accounts with arbitrary roles including Administrator, exploit requires user with Contributor or higher privileges.

  • 8.1 /10 High
    CVE-2026-81268 Auth required

    IBM Langflow OSS - Authentication Bypass

    IBM Langflow OSS 1.0.0 through 1.11.5 contains an authentication bypass caused by insufficient session expiration of API keys after user deactivation, letting remote authenticated attackers execute flows and obtain sensitive information.