High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 187 of 556
- 7.1 /10 HighCVE-2026-98180 Auth required
Linux Kernel drm/msm - Use After Free
Linux kernel drm/msm contains a use-after-free vulnerability caused by freeing scheduler-containing ring and VM objects without RCU grace period, letting unprivileged userspace access freed memory via SYNC_IOC_FILE_INFO.
- 7.5 /10 HighCVE-2026-98175 No auth
Linux Kernel smb client - Use After Free
Linux kernel contains a use-after-free vulnerability in smb client due to not canceling server->reconnect delayed work in clean_demultiplex_info(), letting attackers cause memory corruption, exploit requires triggering demultiplex thread exit with queued reconnect work.
- 7.5 /10 HighCVE-2026-98174
Linux Kernel smb client - Race Condition
Linux kernel smb client contains a race condition and missing initialization in TCP_Server_Info.rlist, caused by improper list pointer handling and concurrent access, letting attackers cause list corruption, exploit requires concurrent cifsd threads.
- 7.5 /10 HighCVE-2026-98173
Linux Kernel smb client - Use After Free
Linux kernel contains a use-after-free vulnerability in smb client caused by improper handling of iface list during channel addition in cifs_try_adding_channels(), letting attackers cause memory corruption or denial of service, exploit requires concurrent interface refresh.
- 8.8 /10 HighCVE-2026-98171 No auth
Linux Kernel smb client - Use After Free
Linux kernel contains a use-after-free vulnerability caused by improper handling of next_buffer and bounds checking in smb client compound PDUs, letting attackers cause memory corruption, exploit requires crafted encrypted SMB frames.
- 7.1 /10 HighCVE-2026-98169
Linux Kernel - Out-of-Bounds Read
Linux kernel contains an out-of-bounds read caused by improper length verification in smb3_enum_snapshots(), letting local attackers leak adjacent kernel memory to userspace, exploit requires crafted short SMB server reply.
- 7.8 /10 HighCVE-2026-98166 Auth required
Linux Kernel drm/ttm - Use After Free
Linux kernel drm/ttm contains a use-after-free caused by missing removal of swapped-out resources from bulk_move range in ttm_bo_swapout_cb(), letting attackers trigger system crashes or memory corruption after hibernation, exploit requires system suspend-then-hibernate usage.
- 8.8 /10 HighCVE-2026-96890 Auth required
GitHub Enterprise Server - Server-Side Request Forgery
GitHub Enterprise Server 3.20, 3.21, and 3.22 contain a server-side request forgery caused by the secret scanning validator trusting token endpoints in committed credentials, letting authenticated repository contributors cause requests to attacker-controlled internal hosts, exploit requires authenticated user with push permission and GitHub Advanced Security enabled.
- 7.5 /10 HighCVE-2026-96580 No auth
Gitea - Denial of Service
Gitea contains a denial of service caused by unbounded expansion of static strategy.matrix in workflows, letting attackers opening fork pull requests consume server memory and terminate the process, exploit requires ability to open fork pull requests.
- 8.1 /10 HighCVE-2026-96404 PoC publicNo auth
Gitea - Authentication Bypass
Gitea contains an authentication bypass caused by the web installer issuing sessions for existing users without password verification when INSTALL_LOCK is false, letting attackers gain admin access, exploit requires installer access.
- 7.5 /10 HighCVE-2026-96399 No auth
Gitea - Denial of Service
Gitea contains a denial of service caused by invalid slice indexes from external issue tracker regex with alternating capture groups, letting users who can edit issue tracker settings crash the instance, exploit requires repository settings modification.
- 8.1 /10 HighCVE-2026-95594 No auth
SMS Alert Order Notifications - Privilege Escalation
SMS Alert Order Notifications <= 4.0.0 contains a privilege escalation vulnerability caused by unauthenticated access, letting attackers escalate privileges without authentication.
- 7.3 /10 HighCVE-2026-95526 No auth
BEAR - Broken Access Control
BEAR <= 1.2.2 contains a broken access control vulnerability caused by improper authorization checks, letting unauthenticated attackers access restricted resources, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-95140 No auth
kkFileView - Path Traversal
kkFileView v5.0.0 through v5.0.2 contains a path traversal vulnerability caused by improper validation of the "path" parameter in FileController.java endpoints, letting unauthenticated attackers create directories and write files outside the intended root via crafted multipart requests.
- 8.2 /10 HighCVE-2026-95105
danielberkompas cloak - Reliance on Obfuscation or Encryption without Integrity Checking
danielberkompas cloak from 0.1.0-pre onward contains a reliance on obfuscation or encryption of security-relevant inputs without integrity checking caused by use of AES-256 CTR mode encryption without MAC, letting attackers with write access to ciphertext modify decrypted plaintext via bit flipping, exploit requires write access to encrypted store.