High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 124 of 552
- 7.5 /10 HighCVE-2026-100113 No auth
CAI Content Credentials - Security Feature Bypass
CAI Content Credentials contains an improper input validation vulnerability that allows attackers to bypass security features and gain unauthorized write access, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-100112 No auth
Adobe Photoshop Desktop - Remote Code Execution
Adobe Photoshop Desktop contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 7.8 /10 HighCVE-2026-100111 No auth
Photoshop Desktop - Remote Code Execution
Photoshop Desktop contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 8.3 /10 HighCVE-2025-58774 Auth required
AMI APTIOV - Buffer Overflow
AMI APTIOV BIOS contains a buffer overflow caused by buffer access with incorrect length value, letting local attackers execute arbitrary code, exploit requires local access.
- 7.1 /10 HighCVE-2025-58773 Auth required
AMI APTIOV - Buffer Overflow
AMI APTIOV BIOS contains an out-of-bounds write vulnerability caused by improper bounds checking, letting local attackers cause buffer overflows, memory corruption, and arbitrary code execution, exploit requires local access.
- 8.2 /10 HighCVE-2025-58772 Auth required
AMI APTIOV - Buffer Overflow
AMI APTIOV contains a buffer overflow vulnerability in BIOS, letting local attackers cause memory corruption and execute arbitrary code, exploit requires local access.
- 7.1 /10 HighCVE-2025-58771 Auth required
AMI APTIOV - Integer Overflow
AMI APTIOV BIOS contains an integer overflow caused by improper handling of integer values, letting local attackers cause buffer overflows, memory corruption, and arbitrary code execution, exploit requires local access.
- 8.8 /10 HighCVE-2025-57739 Auth required
Fortinet FortiMail - SQL Injection
Fortinet FortiMail 7.2.0 through 7.2.8, 7.4.0 through 7.4.5, and 7.6.0 through 7.6.3 contain an SQL injection caused by improper neutralization of special elements in SQL commands, letting authenticated attackers execute unauthorized code or commands via crafted HTTP/HTTPS requests.
- 8.8 /10 HighCVE-2025-46773 Auth required
Fortinet FortiAnalyzer - SQL Injection
Fortinet FortiAnalyzer 7.2 all versions, 7.4.0 through 7.4.7, and 7.6.0 through 7.6.4, including FortiAnalyzer Cloud versions 7.2.1 through 7.2.11, 7.4.1 through 7.4.7, and 7.6.2 through 7.6.4 contain an SQL injection caused by improper neutralization of special elements in SQL commands, letting low privileged users execute arbitrary commands via crafted requests.
- 7.5 /10 HighCVE-2026-96612 No auth
hexpm hex - Path Traversal
hexpm hex from 0.6.0 before 2.5.2 contains a path traversal caused by improper validation of app label in package requirements, letting malicious package publishers delete and write files outside the deps directory, exploit requires a malicious package release.
- 8.2 /10 HighCVE-2026-96266 Auth required
IBM Power Systems Firmware - Memory Corruption
IBM Power Systems Firmware FW1060.00 through FW1060.81 contains a memory corruption vulnerability caused by improper host firmware configuration parsing, letting authenticated service-level attackers compromise the host firmware boot stack and hypervisor during system IPL.
- 8.2 /10 HighCVE-2026-96265 Auth required
IBM Power Systems Firmware - Broken Access Control
IBM Power Systems Firmware FW1060.00 through FW1060.81 contains a broken access control vulnerability caused by improper validation in the service processor mailbox interface, letting authenticated service-level attackers read or modify Hostboot memory, exploit requires authenticated service-level access.
- 8.2 /10 HighCVE-2026-96264 Auth required
IBM Power Systems Firmware - Remote Code Execution
IBM Power Systems Firmware FW1060.00 through FW1060.81 contains a buffer overflow vulnerability in the service processor mailbox interface, letting authenticated service-level attackers execute arbitrary code in host firmware runtime, exploit requires authenticated service-level access.
- 8.2 /10 HighCVE-2026-96263
IBM Power Systems Firmware - Remote Code Execution
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 contain a remote code execution vulnerability caused by improper validation in the host firmware boot process image path, letting attackers with service processor access execute arbitrary code on the host system.
- 8.2 /10 HighCVE-2026-96262 Auth required
IBM Power Systems Firmware - Remote Code Execution
IBM Power Systems Firmware FW1060.00 through FW1060.81 contains a buffer overflow vulnerability in the service processor mailbox interface, letting authenticated service-level attackers execute arbitrary code in host firmware runtime.