High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 198 of 568
- 7.8 /10 HighCVE-2026-98260 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by delayed cleanup of POSIX timers after de_thread() during exec, letting attackers cause kernel memory corruption, exploit requires triggering execve failure in non-leader threads.
- 7.8 /10 HighCVE-2026-98258 Auth required
Linux Kernel - Use-After-Free
Linux kernel contains a use-after-free vulnerability in POSIX CPU timers caused by improper handling of timer firing state during expiry list operations, letting attackers cause memory corruption, exploit requires triggering timer expiry and deletion race conditions.
- 7.5 /10 HighCVE-2026-98257 No auth
Linux Kernel - Denial of Service
Linux kernel contains a deadlock vulnerability in rds_ib_cm_connect_complete() caused by improper use of rds_conn_destroy() on protocol version mismatch, letting attackers cause a denial of service by stalling RDS connection workqueues, exploit requires triggering a protocol version mismatch.
- 7.8 /10 HighCVE-2026-98256 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in signal handling caused by race conditions during exec() in __send_signal_locked, letting attackers cause kernel memory corruption, exploit requires triggering non-leader execve with posix timer signals.
- 7.8 /10 HighCVE-2026-98254 Auth required
Linux Kernel - Data Corruption
Linux kernel contains a data corruption vulnerability caused by incorrect address adjustment in swiotlb_bounce() during highmem page lookup, letting attackers cause stale or incorrect DMA data, exploit requires crafted DMA operations.
- 7.8 /10 HighCVE-2026-98253 Auth required
Linux Kernel RDMA/ucma - Use After Free
Linux kernel RDMA/ucma contains a race condition caused by improper mutex handling in rdma_join_multicast and rdma_leave_multicast functions, letting concurrent join and leave calls cause use-after-free, exploit requires concurrent multicast join calls.
- 7.0 /10 HighCVE-2026-98252
Linux Kernel - Race Condition
Linux kernel contains a reference count bug in iwpm_get_nlmsg_request() caused by improper initialization order of refcount and list_add_tail(), letting concurrent CPUs cause refcount addition on zero, exploit requires concurrent access to global list.
- 7.8 /10 HighCVE-2026-98251
Linux Kernel openvswitch - Use After Free
Linux kernel openvswitch contains a use-after-free vulnerability caused by reallocating confirmed conntrack labels in ovs_ct_get_conn_labels(), letting concurrent CPU access cause memory corruption, exploit requires concurrent access to conntrack entries.
- 7.1 /10 HighCVE-2026-98243 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use after free vulnerability caused by improper checking of signaling bit and ops pointer in dma-buf/dma-fence, letting attackers potentially cause memory corruption, exploit requires kernel-level access.
- 7.8 /10 HighCVE-2026-98241 Auth required
Linux Kernel - Out of Bounds Read
Linux kernel contains a memory misinterpretation vulnerability in IPv6 xfrm local error paths caused by dereferencing skb->sk as a full socket when it may be a mini-socket, letting attackers cause out-of-bounds read, exploit requires triggering specific IPv6 XFRM tunnel routes with lower MTU.
- 8.1 /10 HighCVE-2026-98239 No auth
Linux kernel lan743x - Use After Free
Linux kernel net: lan743x contains a use-after-free vulnerability caused by improper handling of RX checksum in lan743x_rx_process_buffer, letting attackers cause memory corruption, exploit requires multi-buffer packet reception.
- 7.0 /10 HighCVE-2026-98230
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by improper list deletion in xfrm state_cache and state_cache_input, letting attackers cause memory corruption and potential read/write use-after-free, exploit requires triggering double __xfrm_state_delete calls.
- 7.8 /10 HighCVE-2026-98229
CVE-2026-98229
In the Linux kernel, the following vulnerability has been resolved: xfrm: save input state data before secpath resets xfrm_input() stores the current xfrm_state in the skb secpath while it continues receive-side processing. Some input paths can reset that secpath before xfrm_input() has finished dereferencing the state. Receive callback users such as VTI and XFRM interfaces can reset the secpath. The VTI receive path does so before checking whether the packet crosses network namespaces, while the XFRM interface path does so only for cross-network-namespace packets. The XFRM_MAX_DEPTH error path can also reset the secpath before the final drop callback reports the current state's protocol. If secpath_reset() drops the last state reference while the state is concurrently deleted, xfrm_input() can still dereference the freed state when selecting transport_finish() or reporting the drop callback protocol. Save the state protocol on the stack while the state is still valid, and use the already saved address family for transport_finish(). A larval XFRM_STATE_ACQ state has no type, so retain nexthdr as its protocol. This preserves the existing drop-path fallback while avoiding the post-reset state dereferences without adding an extra state reference to every received packet.
- 7.8 /10 HighCVE-2026-98228
Linux Kernel - Race Condition
Linux kernel on MIPS I6500 CPU cores contains a memory ordering vulnerability caused by lack of sync instructions around lld/scd loops, letting attackers cause kernel paging faults and crashes, exploit requires running code on affected CPU cores.
- 7.1 /10 HighCVE-2026-98216
Linux Kernel - Denial of Service
Linux kernel contains a memory mapping vulnerability in IB/hfi1 PIO_CRED credit-return mmap caused by incorrect pointer arithmetic and improper DMA API usage, letting local users cause kernel Oops and send PIO stalls, exploit requires local access to affected hardware context.