High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 223 of 568
- 7.8 /10 HighCVE-2026-58815 Auth required
Unknown - Out of Bounds Write
Unknown product contains an out of bounds write caused by incorrect bounds check, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-55286 Auth required
stpropnci - Privilege Escalation
stpropnci contains an out of bounds write caused by incorrect bounds check in stpropnci_process, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 8.8 /10 HighCVE-2026-55280 Auth required
Multiple Products - Privilege Escalation
Multiple products contain an out-of-bounds write caused by uninitialized data, letting remote attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-55270 Auth required
Generic Software - Privilege Escalation
A software contains a permission bypass caused by a confused deputy issue in dialInternal, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-55269 Auth required
snoop_logger.cc - Memory Safety
snoop_logger.cc contains a memory safety issue caused by improper input validation in FilterCapturedPacket, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-55266 Auth required
libufdt - Privilege Escalation
libufdt contains an out-of-bounds write caused by resource exhaustion in qsort of libufdt_sysdeps_vendor.c, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-49937 Auth required
MessageQueueBase - Privilege Escalation
MessageQueueBase contains an out of bounds read caused by incorrect bounds check in multiple functions, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-49933 Auth required
Microsoft Bluetooth - Privilege Escalation
Microsoft Bluetooth privileged process contains a local privilege escalation caused by uninitialized pointer dereference in handle_le_monitor_device_event, letting local attackers hijack control flow, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-49885 Auth required
rw_t4t - Integer Overflow
rw_t4t.cc contains an integer overflow in rw_t4t_update_file causing an out-of-bounds write, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-49880 Auth required
nfa_nfcee_act.cc - Out of Bounds Write
nfa_nfcee_act.cc contains an out-of-bounds write caused by missing bounds check in multiple functions, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.2 /10 HighCVE-2026-49878 Auth required
wpas_handle_robust_av_scs_recv_action - Buffer Overflow
A vulnerability in wpas_handle_robust_av_scs_recv_action of robust_av.c contains a buffer overflow caused by a logic error, letting remote attackers execute code with system privileges, exploit requires no user interaction.
- 8.8 /10 HighCVE-2026-45524 Auth required
WifiPermissionsUtil - Broken Access Control
WifiPermissionsUtil in isSystem method contains a missing permission check causing a sandbox escape, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-28648 Auth required
Settings - Privilege Escalation
Settings contains a permission bypass caused by a confused deputy issue, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-28647 Auth required
DeviceAdminAppsPreferenceController - Broken Access Control
DeviceAdminAppsPreferenceController contains a permission bypass caused by a logic error in updateState method, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-28641 Auth required
ApplicationActionButtonsPreferenceController - Broken Access Control
ApplicationActionButtonsPreferenceController contains a permission bypass caused by a logic error in shouldDisableUninstallButton, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.