High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 642 of 725
- 7.4 /10 HighCVE-2026-90647 No auth
ASE/Kalkitech ASE2000 V2 - Man-in-the-Middle
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 contains a man-in-the-middle vulnerability caused by improper certificate validation in the IEC 60870-5-104 TLS client (Task Mode), letting network-positioned attackers intercept protected communications, exploit requires attacker to be positioned on the network.
- 7.4 /10 HighCVE-2026-90616 No auth
Flatpak - Sandbox Escape & Arbitrary Code Execution
Flatpak < 1.18.1 contains a sandbox escape vulnerability caused by missing symlink protection in app data directories, letting malicious sandboxed apps gain arbitrary read/write and code execution on the host, exploit requires attacker-controlled symlinks.
- 8.2 /10 HighCVE-2026-90560 No auth
zstd-jni - Denial of Service
zstd-jni 1.2.0 through 1.5.7-13 contains an out-of-bounds read vulnerability caused by lack of validation of offset and length arguments in ZstdDictDecompress constructor, letting attackers cause JVM termination by reading memory past array bounds, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-90559 No auth
snappy-java - Buffer Overflow
snappy-java through 1.1.10.8 contains a buffer overflow caused by lack of validation of destination buffer capacity in Snappy.uncompress(ByteBuffer, ByteBuffer), letting attackers cause JVM termination by writing past buffer boundaries, exploit requires crafted compressed data.
- 7.8 /10 HighCVE-2026-90556 No auth
Freeciv - Buffer Overflow
Freeciv < 3.2.6 contains a heap buffer overflow caused by processing savegame files with worklist lengths exceeding array bounds in worklist_load(), letting attackers corrupt memory when loading crafted savegame files, exploit requires loading malicious savegame.
- 7.8 /10 HighCVE-2026-90553 No auth
vLLM - Remote Code Execution
vLLM < 0.28.0 contains a remote code execution caused by ignoring the trust_remote_code parameter in LlavaOnevision2 processor loader, letting attackers execute arbitrary code with vLLM process authority, exploit requires crafted malicious model.
- 8.2 /10 HighCVE-2026-90537 No auth
WWBN AVideo - Broken Access Control
WWBN AVideo contains a missing authorization vulnerability caused by insufficient access control in plugin/Scheduler/sendEmail.json.php, letting unauthenticated attackers enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by providing a valid site-wide daily token.
- 7.5 /10 HighCVE-2026-90535 PoC public
Flowise - Denial of Service
Flowise < 3.1.4 contains an unauthenticated denial of service vulnerability caused by lack of ownership verification in /api/v1/text-to-speech/abort endpoint, letting attackers terminate active chatflow predictions, exploit requires known chatflow and chat identifiers.
- 8.2 /10 HighCVE-2026-89266 No auth
stb_vorbis - Buffer Overflow
stb_vorbis through 1.22 contains a buffer overflow caused by truncation of codebook multiplicands allocation size from size_t to int in start_decoder(), letting attackers trigger heap corruption or crashes via crafted Ogg Vorbis files, exploit requires crafted file.
- 8.0 /10 HighCVE-2026-87888 Auth required
YayPricing WordPress plugin - Stored XSS
YayPricing WordPress plugin < 3.5.7 contains a stored XSS caused by missing authorization check on a REST route saving pricing rules, letting users with subscriber role store JavaScript executing in admin's browser, exploit requires subscriber role or higher.
- 7.5 /10 HighCVE-2026-87842 No auth
Zonify WordPress - Authentication Bypass
Zonify WordPress plugin < 1.0.5 contains an authentication bypass caused by missing capability and authentication checks before returning stored account login token, letting unauthenticated attackers retrieve and use the token.
- 8.8 /10 HighCVE-2026-87759 Auth required
Add User Autocomplete WordPress plugin - Broken Access Control
Add User Autocomplete WordPress plugin < 1.2 contains a broken access control vulnerability caused by lack of capability and nonce checks in site-membership invitation creation, letting authenticated users escalate privileges to administrator on multisite installations, exploit requires authentication.
- 7.5 /10 HighCVE-2026-85200 No auth
GEO my WP - Local File Inclusion
GEO my WP WordPress plugin <= 4.5.5.3 contains a local file inclusion caused by improper handling in gmw_posts_locator_ajax_info_window_loader function, letting unauthenticated attackers execute arbitrary PHP code remotely.
- 8.1 /10 HighCVE-2026-84099 No auth
wpstorecart WordPress Plugin - Insecure Deserialization
wpstorecart WordPress plugin through 5.0.7 contains an insecure deserialization vulnerability caused by direct unauthenticated access to a bundled add-on that deserializes user input without class restrictions, letting unauthenticated attackers inject arbitrary PHP objects, exploit requires no authentication.
- 8.6 /10 HighCVE-2026-84047 No auth
Album Cover Finder WordPress - SQL Injection
Album Cover Finder WordPress plugin <= 0.7.0 contains a sql injection caused by improper sanitization and escaping of a parameter in SQL query, letting unauthenticated attackers execute arbitrary SQL commands remotely.