High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 373 of 568
- 7.8 /10 HighCVE-2026-93095 Auth required
Linux Kernel - Out of Bounds Read/Write
Linux kernel contains a buffer overflow caused by improper validation of HFS+ thread record size and type in hfsplus_delete_cat(), letting attackers with a corrupted image trigger out-of-bounds write, exploit requires crafted corrupted HFS+ image.
- 7.8 /10 HighCVE-2026-93079 Auth required
Linux Kernel - Out of Bounds Write
Linux kernel contains a heap out-of-bounds write caused by improper validation of feature count against output buffer size in cxlctl_get_feature(), letting attackers cause memory corruption, exploit requires crafted request.
- 7.8 /10 HighCVE-2026-93074 Auth required
Linux Kernel - Memory Address Calculation Flaw
Linux kernel contains a memory address calculation flaw in dax/fsdev direct_access caused by incorrect virtual address computation, letting attackers cause incorrect kernel virtual address usage, exploit requires kernel-level access.
- 7.8 /10 HighCVE-2026-93070
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by double freeing auxiliary device pdata in ipu6_bus_initialize_device, letting attackers cause system instability or denial of service, exploit requires triggering MMU initialization failure or auxiliary device add failure.
- 8.4 /10 HighCVE-2026-93063 No auth
Linux Kernel - Buffer Overflow
Linux kernel contains a buffer overflow caused by improper SAP message length validation in iwlwifi mei component, letting attackers cause memory corruption, exploit requires crafted SAP messages.
- 7.0 /10 HighCVE-2026-93054 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in UIO device registration caused by stale info pointer after failed registration, letting local userspace attackers cause memory corruption, exploit requires race condition during device setup failure.
- 7.0 /10 HighCVE-2026-93046 Auth required
Linux Kernel - Out of Bounds Read
Linux kernel contains an out of bounds read caused by improper bounds check in software_node_get_reference_args() when passed UINT_MAX, letting attackers cause memory corruption, exploit requires crafted input.
- 7.8 /10 HighCVE-2026-93045
Linux Kernel - Memory Corruption
Linux kernel contains a memory corruption vulnerability caused by improper handling of scalar arena addresses in bpf_arena_free_pages(), letting attackers cause out-of-range frees leading to potential memory corruption, exploit requires crafted scalar arena addresses.
- 8.8 /10 HighCVE-2026-93042 No auth
Linux Kernel dmaengine - Use After Free
Linux kernel dmaengine dw-edma contains a use-after-free vulnerability caused by late callbacks after dmaengine_terminate_sync() in descriptor termination, letting attackers cause memory corruption or leaks, exploit requires device to perform DMA transfers.
- 7.4 /10 HighCVE-2026-93039
Linux Kernel ASoC meson - Use After Free
Linux kernel ASoC meson contains a use-after-free and double free caused by improper handling of link pointers on krealloc failure in meson_card_reallocate_links(), letting attackers cause memory corruption, exploit requires kernel code execution.
- 7.8 /10 HighCVE-2026-93037
Linux Kernel RDMA/hfi1 - Broken Authentication
Linux kernel RDMA/hfi1 contains a broken authentication caused by set_txreq_header_ahg() ignoring sdma_txinit_ahg() errors, letting attackers cause improper request processing, exploit requires kernel-level access.
- 7.1 /10 HighCVE-2026-93014 Auth required
RosarioSIS - Path Traversal
RosarioSIS < 12.9 contains a path traversal caused by improper validation of filename parameter in Users and Students modules, letting authenticated users delete allow-listed files, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-92987 No auth
roxmltree - Denial of Service
roxmltree through 0.21.1 contains a denial of service caused by quadratic-time attribute and namespace validation during XML parsing without limits on attribute count, letting attackers consume excessive CPU time, exploit requires crafted XML documents with many attributes.
- 8.8 /10 HighCVE-2026-92986 No auth
SiYuan - Stored XSS
SiYuan before 3.8.4 contains a stored XSS caused by unescaped HTML in document titles in the backlink dock tree, letting attackers execute scripts in the Electron renderer with command execution, exploit requires attacker to set malicious titles via rename API or crafted notebooks.
- 8.8 /10 HighCVE-2026-92985 No auth
SiYuan - Stored XSS
SiYuan < 3.8.4 contains a stored XSS caused by unescaped bookmark labels imported from notebook files in the dock tree, letting attackers execute scripts with child_process access for command execution, exploit requires crafted .sy notebook files.