High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 117 of 552
- 7.5 /10 HighCVE-2026-103577 No auth
Microsoft QUIC - Authentication Bypass
Microsoft QUIC contains an insecure default variable initialization vulnerability, letting unauthorized attackers bypass a security feature over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-103575 No auth
Remote Desktop Client - Remote Code Execution
Remote Desktop Client contains a use after free vulnerability allowing unauthorized attackers to execute code over a network, exploit requires network access without special privileges.
- 8.8 /10 HighCVE-2026-103572 No auth
Visual Studio Tools for Applications & SQL Server Management Studio - Command Injection
Visual Studio Tools for Applications and SQL Server Management Studio contain a code injection vulnerability caused by improper control of code generation, letting unauthorized attackers execute code remotely, exploit requires network access.
- 7.5 /10 HighCVE-2026-103569 No auth
Windows IKE Extension - Information Disclosure
Windows IKE Extension contains an out-of-bounds read caused by improper memory handling, letting unauthorized attackers disclose information over a network, exploit requires no special privileges.
- 7.8 /10 HighCVE-2026-103568 Auth required
Windows Credential Providers - Privilege Escalation
Windows Credential Providers contain a race condition caused by concurrent execution using shared resources with improper synchronization, letting authorized attackers elevate privileges locally, exploit requires local access.
- 7.0 /10 HighCVE-2026-103565 Auth required
Windows Broadcast DVR User Service - Privilege Escalation
Windows Broadcast DVR User Service contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory corruption.
- 7.5 /10 HighCVE-2026-103558 No auth
Microsoft Windows Routing and Remote Access Service - Denial of Service
Microsoft Windows Routing and Remote Access Service contains a deadlock vulnerability causing denial of service, letting unauthorized attackers disrupt network services, exploit requires network access.
- 7.0 /10 HighCVE-2026-103555 Auth required
Virtual Hard Disk Miniport Driver - Privilege Escalation
Virtual Hard Disk (VHD) Miniport Driver contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.0 /10 HighCVE-2026-103554 Auth required
Windows Broadcast DVR User Service - Privilege Escalation
Windows Broadcast DVR User Service contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory corruption.
- 7.8 /10 HighCVE-2026-103553 Auth required
Windows Partition Management Driver - Privilege Escalation
Windows Partition Management Driver contains an out-of-bounds read caused by improper memory handling, letting authorized attackers elevate privileges locally, exploit requires local access with authorization.
- 7.5 /10 HighCVE-2026-103499 No auth
IBM WebSphere Application Server Liberty - Denial of Service
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10, and IBM WebSphere Application Server 8.5 and 9.0 Liberty contain a denial of service caused by uncontrolled resource consumption, letting remote unauthenticated attackers cause service disruption, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-103418 No auth
Firefox for iOS - Stored XSS
Firefox for iOS < 157.1 contains a stored XSS caused by direct interpolation of the page's HTML language attribute into translation JavaScript, letting attackers execute code in privileged content and bypass CSP, exploit requires attacker-controlled markup.
- 7.1 /10 HighCVE-2026-103316 Auth required
DigiD - Code Injection
DigiD macOS app contains a code injection vulnerability caused by lack of Hardened Runtime signing, letting local attackers execute arbitrary code and access sensitive data, exploit requires local user-level code execution.
- 7.5 /10 HighCVE-2026-103297 No auth
CAI Content Credentials - Authentication Bypass
CAI Content Credentials contains an improper verification of cryptographic signature vulnerability, letting attackers bypass security features and gain unauthorized write access, exploit requires no user interaction.
- 7.5 /10 HighCVE-2026-103296 No auth
CAI Content Credentials - Authentication Bypass
CAI Content Credentials contains an improper verification of cryptographic signature vulnerability, letting attackers bypass security features and gain unauthorized write access, exploit requires no user interaction.