High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 111 of 552
- 7.0 /10 HighCVE-2026-108135 Auth required
Windows Backup Engine - Privilege Escalation
Windows Backup Engine contains a broken access control vulnerability caused by improper link resolution before file access, letting authorized attackers locally elevate privileges, exploit requires local access with authorization.
- 7.0 /10 HighCVE-2026-108134 Auth required
Windows Autopilot - Privilege Escalation
Windows Autopilot contains a use after free vulnerability that allows an authorized attacker to elevate privileges locally, exploit requires attacker to be authorized.
- 7.8 /10 HighCVE-2026-108133 Auth required
Windows Modern Device Management - Privilege Escalation
Windows Modern Device Management contains a privilege escalation caused by release of invalid pointer or reference, letting authorized attackers elevate privileges locally, exploit requires attacker authorization.
- 7.0 /10 HighCVE-2026-108132 Auth required
Windows Kerberos - Privilege Escalation
Windows Kerberos contains a double free vulnerability caused by improper memory management, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.5 /10 HighCVE-2026-108131 No auth
Active Directory Federation Services - Authentication Bypass
Active Directory Federation Services (AD FS) contains a spoofing vulnerability caused by insufficient authentication validation, letting unauthorized attackers perform network spoofing, exploit requires network access.
- 7.8 /10 HighCVE-2026-108130 Auth required
Windows Virtualization-Based Security Enclave - Privilege Escalation
Windows Virtualization-Based Security (VBS) Enclave contains a heap-based buffer overflow, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.7 /10 HighCVE-2026-106634 Auth required
Adobe Experience Manager - Path Traversal
Adobe Experience Manager contains a path traversal caused by improper limitation of pathname to restricted directory, letting low-privileged attackers write arbitrary files to unauthorized locations, exploit requires no user interaction.
- 7.5 /10 HighCVE-2026-106627 No auth
CAI Content Credentials - Denial of Service
CAI Content Credentials contains an uncontrolled resource consumption vulnerability caused by improper resource management, letting attackers cause application denial-of-service, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-106625 No auth
Adobe Framemaker - Remote Code Execution
Adobe Framemaker contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 7.5 /10 HighCVE-2026-106623 No auth
ColdFusion - Broken Access Control
ColdFusion contains an incorrect authorization vulnerability caused by improper access control, letting attackers disclose sensitive memory information, exploit requires no user interaction.
- 8.8 /10 HighCVE-2026-106618 Auth required
ColdFusion - Broken Access Control
ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 8.8 /10 HighCVE-2026-106617 Auth required
ColdFusion - Broken Access Control
ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 8.6 /10 HighCVE-2026-106616 No auth
ColdFusion - XML External Entity Injection
ColdFusion contains an XML External Entity Injection (XXE) vulnerability caused by improper restriction of XML external entity references, letting attackers read arbitrary files, exploit requires no user interaction.
- 8.8 /10 HighCVE-2026-106615 Auth required
ColdFusion - Broken Access Control
ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-106614 Auth required
ColdFusion - Broken Access Control
ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires conditions beyond attacker control.