High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 115 of 552

  • 7.8 /10 High
    CVE-2026-104346 No auth

    Adobe Photoshop Desktop - Remote Code Execution

    Adobe Photoshop Desktop contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.5 /10 High
    CVE-2026-104345 No auth

    CAI Content Credentials - Security Feature Bypass

    CAI Content Credentials contains an improper input validation vulnerability that allows attackers to bypass security features and gain unauthorized write access, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-104344 No auth

    Adobe Framemaker - Remote Code Execution

    Adobe Framemaker contains a heap-based buffer overflow caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-104342 No auth

    Adobe Framemaker - Use After Free

    Adobe Framemaker contains a use after free vulnerability that could result in arbitrary code execution in the context of the current user, letting attackers execute code, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-104341 No auth

    Adobe Framemaker - Remote Code Execution

    Adobe Framemaker contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-104340 No auth

    Adobe Framemaker - Remote Code Execution

    Adobe Framemaker contains a heap-based buffer overflow caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 8.8 /10 High
    CVE-2026-104085 Auth required

    SPIP odt2spip - Command Injection

    odt2spip plugin for SPIP < 4.4.0 contains a command injection caused by insufficient sanitization of filenames in document import, letting authenticated authors execute arbitrary OS commands as the web-server user.

  • 7.8 /10 High
    CVE-2026-103967 No auth

    Adobe Framemaker - Remote Code Execution

    Adobe Framemaker contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-103966 No auth

    Adobe Framemaker - Remote Code Execution

    Adobe Framemaker contains a heap-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 8.7 /10 High
    CVE-2026-103937 No auth

    Misskey - Denial of Service

    Misskey 13.0.0 to 2025.4.1 and 2025.5.0 to 2026.7.0 contains a denial of service caused by missing cleanup during file uploads, letting attackers exhaust storage or file descriptors, exploit requires repeated file uploads.

  • 7.8 /10 High
    CVE-2026-103854 No auth

    Dimension - Buffer Overflow

    Dimension contains a stack-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-103851 No auth

    Substance3D Stager - Buffer Overflow

    Substance3D Stager contains a stack-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 8.6 /10 High
    CVE-2026-103847 No auth

    Dimension - Remote Code Execution

    Dimension contains an untrusted search path vulnerability caused by improper handling of executable search paths, letting local attackers with user permissions execute arbitrary code, exploit requires victim to run the application.

  • 8.6 /10 High
    CVE-2026-103846 No auth

    Dimension - Stored XSS

    Dimension contains an improper neutralization of input during web page generation, letting local attackers with user permissions execute arbitrary code, exploit requires victim to run the application.

  • 8.6 /10 High
    CVE-2026-103845 No auth

    Dimension - Remote Code Execution

    Dimension contains an uncontrolled search path element vulnerability that allows a local attacker with user permissions to execute arbitrary code by tricking a victim into running the application, exploit requires user interaction.