High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 166 of 556
- 7.1 /10 HighCVE-2026-87660 Auth required
Brocade Fabric OS - Broken Access Control
Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an improper file permission and missing authorization vulnerability in the diagnostic kernel module subsystem, letting unprivileged local users disrupt storage fabric operations and invoke privileged hardware tests, exploit requires local unprivileged user access.
- 7.8 /10 HighCVE-2026-87428 Auth required
Brocade ASCG - Broken Access Control
Brocade ASCG < 3.5.0 contains an information disclosure caused by unauthorized local user access to SANnav host network namespace, letting attackers extract stored management credentials, exploit requires local access to ASCG VM.
- 8.8 /10 HighCVE-2026-87424 No auth
Brocade ASCG - Authentication Bypass
Brocade ASCG < 3.5.0 contains a broken authentication caused by use of a hard coded cryptographic key in SupportLink API authentication, letting attackers bypass authentication across deployments, exploit requires no special conditions.
- 8.8 /10 HighCVE-2026-85490 No auth
Brocade ASCG - Path Traversal
Brocade ASCG < 3.5.0 contains a path traversal vulnerability caused by improper sanitization of archive entries in support bundle processing, letting unauthenticated remote attackers write arbitrary files and potentially execute code, exploit requires sending or intercepting archive files.
- 8.8 /10 HighCVE-2026-85489 No auth
Brocade ASCG - Broken Access Control
Brocade ASCG < 3.5.0 contains a broken authentication caused by unauthenticated direct API access in the administrative management service, letting unauthenticated attackers perform privileged actions including data access and modification.
- 7.8 /10 HighCVE-2026-85488 Auth required
Brocade ASCG - Authentication Bypass
Brocade ASCG < 3.5.0 contains a hardcoded default password caused by embedded credentials in a distributed script, letting local authenticated users with read access escalate privileges, exploit requires default configuration.
- 8.8 /10 HighCVE-2026-85487 No auth
Brocade ASCG - Path Traversal
Brocade ASCG < 3.5.0 contains a path traversal caused by insufficient path restriction validation in HTTP service component, letting unauthenticated local network attackers read, write, or delete arbitrary files, exploit requires local network access.
- 8.0 /10 HighCVE-2026-85486 Auth required
Brocade ASCG - Command Injection
Brocade ASCG < 3.5.0 contains a command injection caused by improper processing of user input in configuration forms before validation, letting authenticated users execute arbitrary code on the server, exploit requires authentication.
- 8.8 /10 HighCVE-2026-85423 No auth
Brocade ASCG - Command Injection
Brocade ASCG < 3.5.0 contains a command injection caused by lack of authentication and authorization checks in the data collection service API, letting attackers with network access execute arbitrary system commands remotely, exploit requires network access.
- 7.8 /10 HighCVE-2026-85422
Brocade ASCG - Hardcoded Credentials
Brocade ASCG < 3.5.0 contains a hardcoded cryptographic key vulnerability caused by static keys embedded in software binaries, letting attackers decrypt stored credentials and forge administrative messages, exploit requires access to software binaries.
- 8.8 /10 HighCVE-2026-85421 No auth
Brocade ASCG - Broken Access Control
Brocade ASCG < 3.5.0 contains a broken access control vulnerability caused by improper enforcement of authentication and access control in the HTTPS service, letting unauthenticated attackers with network access issue control commands and modify system configurations, exploit requires network access.
- 7.5 /10 HighCVE-2026-84875 Auth required
IBM Guardium Data Protection - Buffer Overflow
IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a buffer overflow vulnerability that allows remote attackers to execute arbitrary code, exploit requires network access.
- 7.2 /10 HighCVE-2026-84278 Auth required
IBM Guardium Data Protection - Command Injection
IBM Guardium Data Protection 12.2 contains a command injection caused by attacker-controlled arguments in the SUID-root ssh_config_wrapper component, letting authenticated high-privileged users execute commands as root.
- 7.5 /10 HighCVE-2026-84276
IBM Guardium Data Protection - Denial of Service
IBM Guardium Data Protection 12.2.2 contains a denial-of-service vulnerability caused by malformed task data triggering unchecked type assertion in edge-controller gRPC service, letting unauthenticated remote attackers cause process termination, exploit requires network access to gRPC service.
- 7.5 /10 HighCVE-2026-84275 No auth
IBM Guardium Data Protection - Path Traversal
IBM Guardium Data Protection 12.2 contains a path traversal caused by improper validation in the GIM file-upload functionality, letting unauthenticated attackers write arbitrary files to the Collector, exploit requires no authentication.