High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 125 of 552
- 7.3 /10 HighCVE-2026-96261 Auth required
IBM Power Systems Firmware - Denial of Service
IBM Power Systems Firmware FW1060.00 through FW1060.81 contains a denial of service caused by improper host firmware configuration parsing, letting authenticated service-level attackers crash the host firmware boot stack, exploit requires authenticated service-level access.
- 7.8 /10 HighCVE-2026-95837 Auth required
containerd - Privilege Escalation
containerd 2.1.0 to 2.2.7 and 2.3.4 contain a privilege escalation caused by CRIU restoring process security state from checkpoint data instead of enforcing ContainerConfig, letting attackers create containers with elevated privileges, exploit requires ability to create containers from crafted checkpoints.
- 8.1 /10 HighCVE-2026-93892 Auth required
IBM TRIRIGA Application Platform - Information Disclosure
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 contains an information disclosure vulnerability caused by exposure of session tokens in HTML responses, letting remote authenticated attackers obtain sensitive information.
- 7.6 /10 HighCVE-2026-93891 Auth required
IBM TRIRIGA Application Platform - XML External Entity Injection
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 contains an XML external entity injection caused by improper XML input handling, letting remote authenticated attackers obtain sensitive information, exploit requires authentication.
- 7.4 /10 HighCVE-2026-93695
In Progress ShareFile Storage Zones Controller - Remote Code Execution
In Progress ShareFile Storage Zones Controller v5.12.6 and below contains a file system write vulnerability caused by FileCopyService using a remote file identifier without containment enforcement, letting attackers write arbitrary files remotely, exploit requires writable executable IIS-served directory.
- 8.3 /10 HighCVE-2026-92877 No auth
JAXB - XML External Entity Injection
JAXB contains an XML External Entity (XXE) injection caused by insufficient protection relying only on FEATURE_SECURE_PROCESSING, letting attackers read local files via out-of-band XXE, exploit requires untrusted XML unmarshalling.
- 7.5 /10 HighCVE-2026-92876 No auth
IBM Maximo Application Suite - IoT Component - Denial of Service
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 contains a denial of service caused by uncontrolled recursion, letting remote attackers cause service disruption, exploit requires no special conditions.
- 8.6 /10 HighCVE-2026-92682 Auth required
neo4j/graphql - Authorization Bypass
@neo4j/graphql >= 7.0.0 and < 7.6.4 contains an authorization bypass caused by incorrect translation of none quantifier in @authorization filters on relationships and connections, letting authenticated users read, create, or delete protected records, exploit requires authenticated user.
- 7.5 /10 HighCVE-2026-90921 No auth
IBM Maximo AI Service - Denial of Service
IBM Maximo AI Service 9.1.0 and 9.2.0 contain a denial of service caused by improper handling of malformed frames, letting remote attackers terminate the host process, exploit requires network access.
- 7.5 /10 HighCVE-2026-90912 No auth
IBM Maximo AI Service - Denial of Service
IBM Maximo AI Service 9.1.0 and 9.2.0 SaaS contain a denial of service caused by uncontrolled recursion, letting remote attackers cause service disruption, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-90911 No auth
IBM Maximo AI Service - Denial of Service
IBM Maximo AI Service 9.1.0 and 9.2.0 contain a denial of service vulnerability caused by uncontrolled resource consumption, letting remote attackers cause service disruption, exploit requires network access.
- 8.8 /10 HighCVE-2026-87690 No auth
Metasploit Framework - Path Traversal & Remote Code Execution
Metasploit Framework post/apple_ios/gather/ios_image_gather contains a relative path traversal caused by unsanitized file names from a hostile iOS device in file download path, letting attacker-controlled devices achieve arbitrary file write and persistent code execution on the operator's workstation, exploit requires operator to run the gather module.
- 7.5 /10 HighCVE-2026-85975 No auth
Progress MarkLogic Server - Information Disclosure & Man-in-the-Middle
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a cleartext transport vulnerability for Amazon S3 connections by default, letting network-positioned attackers intercept data or credentials, exploit requires network access.
- 7.4 /10 HighCVE-2026-85974
Progress MarkLogic Server - Weak Cryptography
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a TLS certificate hostname validation weakness in outbound connections, letting network-positioned attackers intercept or modify communications, exploit requires network positioning.
- 7.4 /10 HighCVE-2026-85973 No auth
Progress MarkLogic Server - Man in the Middle
Progress MarkLogic Server 12.x < 12.1.0 contains a cleartext transport vulnerability in cluster-management communications, letting network-positioned attackers intercept or modify transmitted information, exploit requires network access.