High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 265 of 568
- 7.8 /10 HighCVE-2026-47497 Auth required
NVIDIA Virtual GPU Manager - Remote Code Execution & Privilege Escalation
NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor tracing component caused by improper access via crafted data through a shared buffer, letting guest VM users execute code, escalate privileges, tamper data, cause denial of service, and disclose information, exploit requires guest VM user access.
- 7.3 /10 HighCVE-2026-47496 Auth required
NVIDIA GPU Display Driver for Linux - Out-of-Bounds Write
NVIDIA GPU Display Driver for Linux contains an out-of-bounds write vulnerability in the Virtual GPU Manager (vGPU plugin) caused by specially crafted RPC calls from guest VM users, letting attackers escalate privileges, tamper data, and cause denial of service.
- 7.8 /10 HighCVE-2026-47495 Auth required
NVIDIA vGPU Virtual GPU Manager - Buffer Overflow
NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a buffer overflow caused by an out-of-bounds write in the kernel mode layer, letting local users execute code, cause DoS, escalate privileges, disclose information, and tamper data.
- 7.8 /10 HighCVE-2026-47494 Auth required
NVIDIA GPU Display Driver for Linux - Format String
NVIDIA GPU Display Driver for Linux contains a format string vulnerability caused by improper input handling, letting local users execute code, escalate privileges, tamper data, cause denial of service, and disclose information, exploit requires local user access.
- 7.8 /10 HighCVE-2026-47493 Auth required
NVIDIA vGPU - Privilege Escalation
NVIDIA vGPU software for Windows and Linux contains a privilege escalation vulnerability caused by improper access control in the GPU kernel driver, letting guest users access privileged host GPU resources, exploit requires guest access.
- 7.8 /10 HighCVE-2026-47491 Auth required
NVIDIA GPU Display Driver for Linux - Use After Free
NVIDIA GPU Display Driver for Linux contains a use after free vulnerability in the kernel mode layer, letting unprivileged users cause improper memory release leading to multiple impacts, exploit requires unprivileged user access.
- 7.8 /10 HighCVE-2026-47489
NVIDIA GPU Display Driver for Linux - Multiple Vulnerabilities
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved, letting attackers execute code, cause denial of service, escalate privileges, disclose information, and tamper data, exploit requires local access.
- 7.5 /10 HighCVE-2026-47097 No auth
AJA HELO Plus - Information Disclosure
AJA HELO Plus firmware < 2.1.7 contains an information disclosure vulnerability caused by a static AES passphrase embedded in obfuscated form, letting unauthenticated attackers decrypt sensitive diagnostics bundles.
- 8.3 /10 HighCVE-2026-46711 Auth required
Soft Machine - Path Traversal
Soft Machine <= 0.2.247 contains an unauthenticated file read vulnerability caused by exposed HTTP endpoints (/health, /file/<path>, /archive/<dir>) on port 8080, letting attackers on the same Fly app/org read arbitrary files and download project archives, exploit requires network access to TCP/8080 on the workspace.
- 7.1 /10 HighCVE-2026-27371 No auth
WPFunnels - Reflected XSS
WPFunnels <= 3.13.1 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-18783 PoC publicNo auth
Trex Digital Smart Manufacturing Systems Inc. Trex MES - Authentication Bypass
Trex Digital Smart Manufacturing Systems Inc. Trex MES through 2026-09-29 contains an authentication bypass caused by missing authentication for critical functions, letting attackers bypass authentication, exploit requires no special conditions.
- 7.2 /10 HighCVE-2026-18145 Auth required
WatchGuard Fireware OS - Buffer Overflow
WatchGuard Fireware OS contains a buffer overflow caused by improper handling in the spamBlocker (spamd) service, letting authenticated administrators crash the service or execute arbitrary code remotely, exploit requires admin privileges.
- 7.2 /10 HighCVE-2026-13046 Auth required
WatchGuard Fireware OS - Insecure Deserialization
WatchGuard Fireware OS contains an insecure deserialization vulnerability in SAML single sign-on session handling (samld), letting attackers with file write access execute arbitrary code via crafted session files.
- 8.7 /10 HighCVE-2026-10764 No auth
BVMS - Information Disclosure
BVMS 4.5 up to 12.3 contains an information disclosure caused by insufficient protection against man-in-the-middle attacks, letting attackers gain unauthorized access to sensitive data, exploit requires network access.
- 7.5 /10 HighCVE-2026-103591 No auth
DeepWiki-Open - Arbitrary File Read
DeepWiki-Open contains an unauthenticated arbitrary file read vulnerability caused by improper validation of the repo_url parameter in the GET /codemap/file endpoint, letting attackers read any file accessible to the API process, exploit requires no authentication.