High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 114 of 552
- 7.5 /10 HighCVE-2026-105592 No auth
Microsoft Office Access - Remote Code Execution
Microsoft Office Access contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-105591 No auth
Microsoft Office Access - Remote Code Execution
Microsoft Office Access contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely over a network, exploit requires network access.
- 8.2 /10 HighCVE-2026-105443 Auth required
IBM WebSphere Application Server Liberty - Broken Access Control
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 contains insufficient isolation between servers sharing an install, letting attackers potentially interfere with other servers, exploit requires shared install environment.
- 7.5 /10 HighCVE-2026-105442 No auth
IBM WebSphere Application Server - Denial of Service
IBM WebSphere Application Server 8.5, 9.0 and Liberty 17.0.0.3 through 26.0.0.10 contain an insecure deserialization vulnerability in the messaging service, letting remote attackers cause denial of service, exploit requires network access.
- 7.4 /10 HighCVE-2026-105013 Auth required
Microsoft Office SharePoint - Insecure Deserialization
Microsoft Office SharePoint contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting authorized attackers execute code over a network, exploit requires attacker authorization.
- 7.5 /10 HighCVE-2026-105009 Auth required
Windows Server Update Service - Privilege Escalation
Windows Server Update Service contains a broken access control vulnerability caused by incorrect default permissions, letting authorized attackers elevate privileges locally, exploit requires local access with authorization.
- 8.8 /10 HighCVE-2026-105007 No auth
Microsoft Windows Network Driver Interface Specification - Privilege Escalation
Microsoft Windows Network Driver Interface Specification (NDIS) contains an elevation of privilege vulnerability caused by improper buffer length validation in ndis.sys, letting local attackers elevate privileges, exploit requires local code execution.
- 8.1 /10 HighCVE-2026-105005 No auth
Windows Schannel - Remote Code Execution
Windows Schannel contains an out-of-bounds write vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 7.8 /10 HighCVE-2026-105004 Auth required
Windows Overlay Filter - Privilege Escalation
Windows Overlay Filter contains an out-of-bounds read vulnerability allowing authorized attackers to elevate privileges locally, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-105003 Auth required
HID class driver - Privilege Escalation
HID class driver contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers elevate privileges locally, exploit requires local access with authorization.
- 7.1 /10 HighCVE-2026-104875 Auth required
Ente - Authorization Bypass
Ente server image < 2026.07.09 contains an authorization bypass caused by insufficient validation of client-supplied userID and recovery-session UUID in /emergency-contacts/approve-recovery endpoint, letting accepted emergency contacts approve recovery and access recovery information prematurely, exploit requires victim to have previously accepted attacker as emergency contact.
- 8.7 /10 HighCVE-2026-104817 No auth
Misskey - Denial of Service
Misskey 12.112.1 to 2026.7.0 contains a denial of service caused by lack of rate limiting and response-size restrictions in unauthenticated fetch-rss API with synchronous XML parsing, letting attackers exhaust resources and amplify requests, exploit requires no authentication.
- 8.5 /10 HighCVE-2026-104816
Misskey - Stored XSS
Misskey 12.0.0 < 2026.7.0 contains a stored XSS caused by missing URL scheme verification in RSS feed item links, letting attackers controlling feed content execute scripts when users click links in RSS widgets, exploit requires attacker to control feed content.
- 7.8 /10 HighCVE-2026-104348 No auth
Adobe Photoshop Desktop - Remote Code Execution
Adobe Photoshop Desktop contains a heap-based buffer overflow caused by processing crafted files, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 7.8 /10 HighCVE-2026-104347 No auth
Adobe Photoshop Desktop - Remote Code Execution
Adobe Photoshop Desktop contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.