High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 643 of 725
- 8.8 /10 HighCVE-2026-81742 No auth
BE REST Endpoints WordPress - Stored XSS
BE REST Endpoints WordPress plugin through 1.0.0 contains a stored XSS caused by lack of authorization and input sanitization in widget operations, letting unauthenticated attackers execute arbitrary scripts in users' browsers.
- 7.1 /10 HighCVE-2026-81429 No auth
WPBakery Page Builder - Stored XSS
WPBakery Page Builder WordPress plugin <= 1.0.2 contains a stored cross-site scripting caused by lack of CSRF check and unsanitized template-import data, letting attackers execute script in administrator session via forged request.
- 7.2 /10 HighCVE-2026-81090 Auth required
Gpx2Graphics WordPress Plugin - Cross Site Request Forgery & Remote Code Execution
Gpx2Graphics WordPress plugin through 0.3 contains a cross site request forgery vulnerability caused by lack of CSRF check and file type validation in file upload handling, letting logged-in administrators upload arbitrary files leading to remote code execution.
- 8.6 /10 HighCVE-2026-80494 No auth
Yogeta WP Cloud WordPress - Path Traversal
Yogeta WP Cloud WordPress plugin through 1.0 contains a path traversal caused by lack of validation of user-supplied file path in a public endpoint, letting unauthenticated attackers download arbitrary files including sensitive credentials.
- 8.6 /10 HighCVE-2026-80491 No auth
SAMO Forms WordPress - SQL Injection
SAMO Forms WordPress plugin through 1.0.0 contains a SQL injection caused by improper sanitization and escaping of user input in several unauthenticated actions, letting unauthenticated attackers execute arbitrary SQL queries.
- 8.8 /10 HighCVE-2026-78175 CISA KEVAuth required
Tutor LMS - Remote Code Execution
Tutor LMS WordPress plugin <= 4.0.7 contains a PHP Object Injection caused by improper handling of the withdraw_method_field parameter in tutor_save_withdraw_account AJAX handler, letting authenticated attackers with subscriber access or higher achieve remote code execution, exploit requires monetization feature enabled and user registration allowed.
- 7.2 /10 HighCVE-2026-77752 Auth required
Temporary Login Without Password WordPress - Broken Access Control
Temporary Login Without Password WordPress plugin < 1.9.9 contains a broken access control caused by missing verification of network super admin rights, letting site administrators escalate privileges to network super admin, exploit requires attacker to be a site administrator.
- 7.2 /10 HighCVE-2026-77705 Auth required
Booking for Appointments and Events Calendar WordPress plugin - Broken Access Control
Booking for Appointments and Events Calendar WordPress plugin < 2.4.10 contains a broken access control vulnerability caused by lack of verification on user entitlement when editing linked WordPress accounts, letting users with customer or employee management permissions modify other users' passwords and emails to take over accounts, exploit requires user to have customer or employee management permissions.
- 7.5 /10 HighCVE-2026-16482 No auth
rtMedia for WordPress - SQL Injection
rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 contains a time-based blind SQL Injection caused by insufficient escaping of the 'compare' parameter in SQL queries, letting unauthenticated attackers extract sensitive database information, exploit requires a public page with rtMedia shortcode and crafted rtmedia_shortcode GET parameter.
- 8.8 /10 HighCVE-2026-15451 Auth required
MemberPress Corporate Accounts - Privilege Escalation
MemberPress Corporate Accounts WordPress plugin <= 1.5.39 contains a privilege escalation caused by mass assignment in 'add_sub_account_user' passing unfiltered 'userdata' to 'wp_insert_user', letting authenticated corporate account users escalate privileges, exploit requires subscriber-level access or higher.
- 7.6 /10 HighCVE-2026-90460 Auth required
OpenStack Keystone - Broken Access Control
OpenStack Keystone < 29.0.3 contains a broken access control vulnerability caused by delegated authentication tokens not being properly restricted in /v3/credentials API, letting attackers create, modify, delete credentials and read sensitive secrets, exploit requires use of delegated authentication tokens.
- 8.1 /10 HighCVE-2026-90456 No auth
Inventory-Management Component - Authentication Bypass
An inventory-management component contains a broken authentication caused by a fixed, publicly-known administrative password in the example environment-configuration file, letting attackers access the administrative interface, exploit requires deployment without running setup routine.
- 8.8 /10 HighCVE-2026-90444 Auth required
Generic File-Transfer Interface - Command Injection
A file-transfer interface requiring valid credentials contains a command injection caused by insufficient sanitization of attacker-controlled filenames, letting authenticated attackers execute arbitrary OS commands with process privileges.
- 7.8 /10 HighCVE-2026-89771 Auth required
Linux Kernel - Race Condition
Linux kernel contains a race condition in ring buffer subbuffer resizing caused by concurrent access to trace_buffer subbuf_size, letting attackers cause data corruption or denial of service, exploit requires concurrent ring buffer access.
- 7.4 /10 HighCVE-2026-89769 No auth
Linux kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by an IRQ leak on cpuhp_setup_state error path in clocksource/drivers/nxp-pit, letting attackers potentially trigger use-after-free via IRQ firing, exploit requires kernel IRQ handling.