High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 346 of 568

  • 8.8 /10 High
    CVE-2026-25264

    Unknown - Privilege Escalation

    Unknown vendor and product contain a privilege escalation caused by weak configuration during package extraction process, letting attackers escalate privileges, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-25255

    Unknown Product - Privilege Escalation

    An unspecified product contains a privilege escalation vulnerability caused by exposed dangerous function in gRPC server, letting attackers escalate privileges, exploit requires unspecified conditions.

  • 7.8 /10 High
    CVE-2026-24267 No auth

    NVIDIA NeMo Speech - Remote Code Execution

    NVIDIA NeMo Speech contains a remote code execution vulnerability caused by malicious data in the speech data explorer component, letting remote attackers execute code and escalate privileges, exploit requires crafted malicious data.

  • 7.8 /10 High
    CVE-2026-24239 No auth

    NVIDIA NeMo Speech - Remote Code Execution

    NVIDIA NeMo Speech contains a remote code execution vulnerability caused by processing malicious data, letting remote attackers execute code, disclose information, and tamper data, exploit requires crafted malicious input.

  • 7.5 /10 High
    CVE-2026-19480 No auth

    CAI Content Credentials - Security Feature Bypass

    CAI Content Credentials contains an improper input validation vulnerability that allows attackers to bypass security features and gain unauthorized write access, exploit requires no user interaction.

  • 7.4 /10 High
    CVE-2026-18176 No auth

    IBM Financial Transaction Manager - Information Disclosure

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an information disclosure vulnerability caused by cleartext transmission of sensitive information, letting remote attackers obtain sensitive data, exploit requires network access.

  • 7.4 /10 High
    CVE-2026-18172 No auth

    IBM Financial Transaction Manager (FTM) - XML External Entity Injection

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an XML external entity injection caused by improper restriction of XML external entity references, letting remote attackers obtain sensitive information, exploit requires crafted XML input.

  • 8.0 /10 High
    CVE-2026-18154 No auth

    IBM Financial Transaction Manager (FTM) - Hardcoded Credentials

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a hardcoded cryptographic key vulnerability, letting remote attackers obtain sensitive information, exploit requires no special privileges.

  • 7.4 /10 High
    CVE-2026-18152 No auth

    IBM Financial Transaction Manager - Authentication Bypass

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a cryptographic signature verification flaw, letting remote attackers forge validly-signed messages, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-18137 No auth

    IBM Financial Transaction Manager - Command Injection

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a command injection caused by improper neutralization of special elements in ESQL commands, letting remote attackers execute arbitrary ESQL commands, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-18134 No auth

    IBM Financial Transaction Manager - Information Disclosure

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an information disclosure vulnerability caused by cleartext transmission of sensitive information, letting remote attackers obtain sensitive data, exploit requires network access.

  • 8.2 /10 High
    CVE-2026-18131 No auth

    IBM Financial Transaction Manager - Stored XSS

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a stored XSS caused by improper neutralization of HTML input, letting remote attackers execute arbitrary JavaScript in authenticated users' browsers, exploit requires user authentication.

  • 7.6 /10 High
    CVE-2026-18123 No auth

    IBM Financial Transaction Manager - Denial of Service

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a denial of service vulnerability caused by improper use of reflection with externally controlled input, letting remote attackers cause service disruption, exploit requires crafted input.

  • 8.5 /10 High
    CVE-2026-18095 Auth required

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift - Buffer Overflow

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a buffer overflow in an unspecified component, letting remote authenticated attackers execute arbitrary code.

  • 8.2 /10 High
    CVE-2026-18074 No auth

    IBM Financial Transaction Manager (FTM) - Broken Access Control

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken access control vulnerability caused by improper authentication and missing authorization, letting remote attackers perform unauthorized actions, exploit requires network access.