High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 371 of 568
- 7.8 /10 HighCVE-2026-93337 Auth required
NetworkManager-l2tp - Command Injection
NetworkManager-l2tp contains an improper input validation vulnerability caused by unvalidated mru or mtu property values in pppd options, letting local users with VPN creation permissions execute arbitrary code as root, exploit requires VPN connection creation permissions.
- 8.5 /10 HighCVE-2026-93292 Auth required
SigNoz - SQL Injection
SigNoz 0.88.0 before 0.142.1 contains a sql injection caused by unescaped interpolation of service_name and span_name fields in trace-funnel analytics endpoints, letting authenticated attackers execute arbitrary SQL queries and read results.
- 7.1 /10 HighCVE-2026-93203 No auth
Linux kernel batman-adv - Data Tampering
Linux kernel batman-adv contains a CRC corruption vulnerability caused by parallel claim add operations in batadv_bla_add_claim(), letting attackers cause incorrect CRC calculations in backbone claims, exploit requires concurrent claim processing.
- 7.8 /10 HighCVE-2026-93201 Auth required
Linux Kernel dm-pcache - Out-of-Bounds Read & Write
Linux kernel dm-pcache contains an out-of-bounds read and write vulnerability caused by lack of validation of seg_id fields from persistent memory in cache device metadata, letting attackers with CAP_SYS_ADMIN privileges cause memory corruption, exploit requires CAP_SYS_ADMIN privilege.
- 8.4 /10 HighCVE-2026-93196 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in virtio_pmem caused by improper refcounting of request tokens in virtio_pmem_host_ack, letting attackers cause kernel memory corruption, exploit requires kernel-level access.
- 7.8 /10 HighCVE-2026-93192 Auth required
Linux Kernel drm/v3d - Use After Free
Linux kernel drm/v3d contains a use-after-free vulnerability caused by not clearing queue->active_job when v3d_fence_create() fails in run_job() callbacks, letting attackers cause system instability or denial of service, exploit requires triggering fence creation failure.
- 8.4 /10 HighCVE-2026-93190
Linux Kernel - Buffer Overflow
Linux kernel contains a buffer overflow caused by lack of bounds checking on source_cap_count and sink_cap_count in cros_typec_register_partner_pdos(), letting attackers cause memory corruption by providing out-of-bounds PD cap counts, exploit requires malicious EC firmware or crafted response.
- 8.8 /10 HighCVE-2026-93189
Linux Kernel HID - Use After Free
Linux kernel contains a use-after-free vulnerability in HID subsystem caused by missing input quiescence in hid_hw_stop(), letting attackers cause memory corruption via in-flight HID reports during driver probe failure, exploit requires driver probe failure with in-flight HID reports.
- 7.1 /10 HighCVE-2026-93178
Linux Kernel - Out of Bounds Read/Write
Linux kernel contains a buffer bounds issue caused by lack of bounds check on voltage index in SMU7 lookup in drm/amdgpu/pm/powerplay, letting attackers cause denial of service or system instability, exploit requires crafted input from VBIOS-parsed tables.
- 7.3 /10 HighCVE-2026-93177 Auth required
Linux kernel - Out of Bounds Read/Write
Linux kernel contains a buffer overflow vulnerability caused by lack of bounds checking on voltage index in Vega10 lookup in drm/amdgpu/pm/powerplay, letting attackers cause denial of service or system instability, exploit requires local access.
- 7.0 /10 HighCVE-2026-93176 Auth required
Linux Kernel - Use After Free
Linux kernel drm/amd/display contains a use-after-free vulnerability caused by improper handling of plane state allocation failure in amdgpu_dm_plane_drm_plane_reset(), letting attackers potentially cause memory corruption or denial of service, exploit requires kernel-level access.
- 7.8 /10 HighCVE-2026-93175 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by a dangling pointer in the drm/amd/display CRTC reset function, letting attackers potentially cause memory corruption or denial of service, exploit requires kernel-level access.
- 7.8 /10 HighCVE-2026-93170 Auth required
Linux kernel dmaengine xilinx_dma - Race Condition
Linux kernel dmaengine xilinx_dma contains a race condition in AXIDMA and MCDMA interrupt handlers causing incorrect channel idle state management, letting attackers cause descriptor corruption or missed completions, exploit requires multiple queued descriptors.
- 7.7 /10 HighCVE-2026-93165 No auth
Linux Kernel platform/chrome sensorhub - Out of Bounds Read
Linux kernel platform/chrome sensorhub contains a memory overread caused by inconsistent EC command response sizes in ring handler, letting attackers trigger out-of-bounds memory read, exploit requires malfunctioning EC firmware.
- 7.8 /10 HighCVE-2026-93154 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by lack of refcounting in RDMA/irdma user ring MRs, letting userspace potentially deregister memory regions backing QP/CQ/SRQ rings, exploit requires userspace access.