High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 686 of 725
- 7.8 /10 HighCVE-2026-21087 Auth required
libmdnie.so - Buffer Overflow
libmdnie.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by out-of-bounds write, letting local attackers execute arbitrary code with system server privileges, exploit requires local access.
- 7.8 /10 HighCVE-2026-21086 Auth required
ProxyHandler - Broken Access Control
ProxyHandler prior to SMR Aug-2026 Release 1 contains an improper authorization vulnerability caused by insufficient access control, letting local attackers access proxy configuration, exploit requires local access.
- 7.5 /10 HighCVE-2026-19201 No auth
Google go-attestation - Denial of Service
Google go-attestation <= 0.6.1 contains a denial of service caused by uncontrolled recursion in the Windows SIPA event log parser's readELAMAggregation function, letting attackers crash the verifier via crafted nested elamAggregation events, exploit requires crafted Windows event log input.
- 8.1 /10 HighCVE-2026-18147 No auth
FreeIPA - Stored XSS
FreeIPA contains a stored XSS caused by DOM manipulation in the Web UI password reset page, letting unauthenticated remote attackers execute arbitrary JavaScript via crafted links, exploit requires victim interaction.
- 7.2 /10 HighCVE-2026-17553 Auth required
WP EasyCart - Privilege Escalation
WP EasyCart <= 5.9.3 contains a privilege escalation caused by insecure update_option() calls in ec_ajax_save_page_default_options() AJAX handler, letting authenticated Store Manager-level users escalate to administrator by modifying WordPress options, exploit requires authenticated user with Store Manager or higher privileges.
- 7.5 /10 HighCVE-2026-16960 No auth
Loops & Logic WordPress - Information Disclosure
Loops & Logic WordPress plugin < 4.3.0 contains an information disclosure vulnerability caused by insufficient restriction on public template-data action, letting unauthenticated users read arbitrary user records and site options, exploit requires no authentication.
- 7.7 /10 HighCVE-2026-15913 Auth required
Fortra GoAnywhere MFT - Path Traversal
Fortra GoAnywhere MFT < 7.10.2 contains a path traversal caused by improper validation in /attachRemoteFiles endpoint, letting web users with Secure Folders and Secure Mail permissions read arbitrary files outside their sandbox, exploit requires specific permissions.
- 7.5 /10 HighCVE-2026-15667 PoC publicAuth required
Eventin WordPress Plugin - Local File Inclusion
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated contributors execute arbitrary PHP code, exploit requires contributor-level access.
- 7.5 /10 HighCVE-2026-15406 Auth required
Eventin WordPress Plugin - Local File Inclusion
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated attackers with custom-level access include and execute arbitrary PHP files, exploit requires authenticated user with custom-level access or higher.
- 7.2 /10 HighCVE-2026-14989 No auth
WPLP Cookie Consent - Stored XSS
WPLP Cookie Consent plugin for WordPress <= 4.4.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'wpl_user_preference' parameter, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires no authentication.
- 8.6 /10 HighCVE-2026-14962 PoC publicNo auth
ELEX WooCommerce Request a Quote - SQL Injection
ELEX WooCommerce Request a Quote WordPress plugin < 2.4.1 contains a SQL injection caused by improper sanitization and escaping of a parameter in a SQL query, letting unauthenticated attackers extract arbitrary data from the database.
- 8.8 /10 HighCVE-2026-14359 CISA KEVAuth required
YITH WooCommerce Waitlist Premium - Privilege Escalation
YITH WooCommerce Waitlist Premium <= 3.35.0 contains a privilege escalation caused by missing capability check and nonce verification in add_user_in_waiting_list() function, letting authenticated attackers with Subscriber-level access create admin users.
- 7.2 /10 HighCVE-2026-13359 No auth
BestWebSoft Contact Form to DB - Stored XSS
BestWebSoft Contact Form to DB plugin for WordPress <= 1.7.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in cntctfrm_contact_dropdown parameter, letting unauthenticated attackers execute scripts in administrator sessions via message manager page, exploit requires unauthenticated contact form submission.
- 8.2 /10 HighCVE-2026-12855 Auth required
HP Projects - Buffer Overflow
HP projects contain a buffer overflow caused by unvalidated memory boundaries in custom code, letting attackers execute arbitrary code remotely, exploit requires no special privileges.
- 7.5 /10 HighCVE-2024-58382 No auth
league/commonmark - Denial of Service
league/commonmark < 2.6.0 contains a denial of service caused by polynomial time complexity in Markdown parsing, letting attackers exhaust CPU and PHP-FPM resources, exploit requires crafted Markdown inputs.