High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 662 of 725
- 8.3 /10 HighCVE-2026-54174
Melange Apko - Package Integrity Bypass
Melange < 0.50.4 and Apko < 1.2.9 contain a package tampering vulnerability caused by missing verification of data section hash in APK packages, letting attackers substitute arbitrary files via mirror compromise or MITM, exploit requires attacker to control package source.
- 7.1 /10 HighCVE-2026-54166 Auth required
Shelf - Server-Side Request Forgery
Shelf prior to version 1.20.3 contains a server-side request forgery caused by bypassing imageUrl validation in the Asset CSV Content Import feature, letting authenticated users with asset:import permission make arbitrary server requests, exploit requires authenticated user with asset:import permission.
- 7.5 /10 HighCVE-2026-54135 No auth
AirSane - Denial of Service
AirSane < 0.4.12 contains a denial of service caused by improper validation of Content-Length header in the custom HTTP server, letting remote unauthenticated attackers crash the service via memory exhaustion.
- 7.5 /10 HighCVE-2026-50013 No auth
Hoverfly - Denial of Service
Hoverfly < 1.12.8 contains a denial of service caused by unsynchronized concurrent writes to the shared responsesDiff map in Diff mode, letting attackers crash the process by sending multiple simultaneous requests.
- 7.5 /10 HighCVE-2026-49846 No auth
libks - Path Traversal
libks < 2.0.11 contains a path traversal vulnerability caused by improper URI canonicalization in clean_uri() allowing embedded ".." sequences to bypass checks, letting attackers access arbitrary filesystem paths, exploit requires crafted URI with excessive path segments.
- 8.1 /10 HighCVE-2026-49464 Auth required
NL Portal Backend Libraries nl.nl-portal:taak - Broken Access Control
NL Portal Backend Libraries nl.nl-portal:taak 1.5.0 through 3.0.0 contains a broken access control vulnerability caused by failure to verify ownership in submitTaakV2 GraphQL mutation, letting authenticated users read, overwrite, and complete other users' tasks, exploit requires authentication.
- 8.1 /10 HighCVE-2026-38058 Auth required
iDirect iQ200 VSAT terminal - Authentication Bypass
iDirect iQ200 VSAT terminal contains an information disclosure vulnerability caused by returning complete device configuration including MD5-crypt password hashes in the SECURITY section, letting authenticated users extract and crack password hashes offline, exploit requires valid web credentials.
- 8.8 /10 HighCVE-2026-38056 Auth required
iDirect iQ200 - Privilege Escalation
iDirect iQ200 VSAT terminal firmware 23.0.1.0 contains a local privilege escalation caused by insufficient privilege restrictions on a pre-configured low-privilege local user account, letting local attackers gain administrative control, exploit requires access to the built-in low-privilege account.
- 8.1 /10 HighCVE-2026-19991 Auth required
UsersWP WordPress Plugin - Arbitrary File Deletion
UsersWP WordPress plugin <= 1.2.70 contains an arbitrary file deletion vulnerability caused by improper validation and normalization of file paths in upload_file_remove() AJAX handler, letting authenticated subscribers delete arbitrary files.
- 7.2 /10 HighCVE-2026-18579 No auth
WP Photo Album Plus - Stored XSS
WP Photo Album Plus for WordPress <= 9.2.08.003 contains a stored cross-site scripting caused by insufficient sanitization of 'HTTP_X_FORWARDED_FOR' parameter, letting unauthenticated attackers inject scripts executed on user page access.
- 7.5 /10 HighCVE-2026-18561 No auth
Unlimited Elements For Elementor - SQL Injection
Unlimited Elements For Elementor for WordPress <= 2.0.16 contains a SQL injection caused by insufficient escaping of the 'addontype' parameter in getWhereString(), letting unauthenticated attackers extract sensitive database information, exploit requires crafted array input.
- 7.2 /10 HighCVE-2026-17037 No auth
Kirki Freeform Page Builder - Stored XSS
Kirki Freeform Page Builder plugin for WordPress <= 6.2.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject and execute arbitrary scripts when users access the page.
- 7.5 /10 HighCVE-2026-15462 No auth
Sticky Chat Widget WordPress - SQL Injection
Sticky Chat Widget WordPress plugin <= 1.4.2 contains a SQL injection caused by unsanitized 'scw_form_fields' parameter array keys in 'scw_save_form_data' AJAX action, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.
- 7.3 /10 HighCVE-2025-15679
BMC - Authentication Bypass
BMC contains a broken authentication caused by the root account being activated without a password after a factory reset, letting attackers gain unauthorized access, exploit requires factory reset operation.
- 7.5 /10 HighCVE-2026-9166 No auth
GIS Informatics GisLab Laboratory Management System - Path Traversal
GIS Informatics GisLab Laboratory Management System >= 1.4.03 < 1.5 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting attackers access unauthorized files, exploit requires crafted request.