High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 398 of 568
- 8.8 /10 HighCVE-2026-89995
CVE-2026-89995
In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dma_direct_alloc_from_pool() Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool helper") changed dma_direct_alloc_from_pool() to return the CPU address from dma_alloc_from_pool(). That fits dma_direct_alloc(), but dma_direct_alloc_pages() also uses the helper and expects a struct page *. Fix this by making dma_direct_alloc_from_pool() return the struct page * again, and pass the CPU address back through an out-parameter for the dma_direct_alloc() caller.
- 7.8 /10 HighCVE-2026-89994
Linux kernel dmaengine fsl-edma - Denial of Service
Linux kernel dmaengine fsl-edma contains a use-after-free vulnerability caused by dereferencing invalid pointers in tracing log output, letting attackers trigger a crash via event injection, exploit requires access to kernel tracing interface.
- 8.4 /10 HighCVE-2026-89992 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by improper freeing of a pointer not at the start of the allocation in cpuidle dt_idle_genpd, letting attackers cause memory corruption, exploit requires local access.
- 7.8 /10 HighCVE-2026-89988 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by unsafe traversal and modification of kprobe_blacklist without proper synchronization, letting attackers cause memory corruption or system instability, exploit requires concurrent module unload and kprobe usage.
- 7.8 /10 HighCVE-2026-89986
Linux Kernel - Denial of Service
Linux kernel contains a sleeping allocation vulnerability in alloc_pages_bulk_weighted_interleave() caused by improper GFP flag usage in atomic context, letting kernel tasks trigger invalid context errors, exploit requires specific mempolicy and atomic context.
- 7.8 /10 HighCVE-2026-89985 Auth required
Linux Kernel - Broken Access Control
Linux kernel contains a broken access control vulnerability caused by incorrect handling of folio's objcg and node association in memcg, letting attackers cause inconsistent memory control group locking, exploit requires kernel-level access.
- 8.4 /10 HighCVE-2026-89980 No auth
Linux Kernel ALSA harmony - Race Condition
Linux kernel ALSA harmony contains a race condition caused by registering IRQ before initializing locks, letting interrupts invoke handlers with uninitialized locks, exploit requires triggering IRQ before initialization.
- 7.8 /10 HighCVE-2026-89979 Auth required
Linux ALSA PCM - Race Condition
Linux kernel ALSA PCM contains a race condition caused by concurrent non-atomic and atomic PCM operations, letting attackers cause inconsistent PCM state and potential system instability, exploit requires concurrent PCM operations.
- 7.5 /10 HighCVE-2026-89974 No auth
Linux Kernel nvme-fc - Use After Free
Linux kernel nvme-fc contains a double free vulnerability caused by improper management of fabrics options pointers in nvme_add_ctrl() error paths, letting attackers cause kernel memory corruption, exploit requires triggering nvme_add_ctrl() failure.
- 8.2 /10 HighCVE-2026-89973 No auth
Linux kernel nvme-tcp - Denial of Service
Linux kernel nvme-tcp contains a denial of service caused by missing data direction check in nvme_tcp_handle_c2h_data(), letting attackers reset the controller by sending invalid C2HData PDUs, exploit requires a malicious NVMe controller.
- 7.5 /10 HighCVE-2026-89971
Linux Kernel NVMe - Denial of Service
Linux kernel NVMe subsystem contains a vulnerability in zone info update caused by improper handling of positive NVMe status codes in nvme_query_zone_info(), letting attackers cause invalid zone size processing and potential kernel errors, exploit requires a device or firmware that fails the Identify Namespace command.
- 7.5 /10 HighCVE-2026-89968 No auth
Linux Kernel nvmet-tcp - Denial of Service
Linux kernel nvmet-tcp contains a denial of service caused by accepting unsolicited H2CData PDUs without verifying R2T transmission, letting remote attackers cause kernel BUG or soft-lockup, exploit requires no authentication on allow_any_host subsystem.
- 7.8 /10 HighCVE-2026-89967 Auth required
Linux Kernel - Out-of-Bounds Write
Linux kernel contains an out-of-bounds write vulnerability in mm/migrate_device caused by improper handling of compound folios in migrate_device_range() and migrate_device_pfns(), letting attackers cause memory corruption, exploit requires local access.
- 7.8 /10 HighCVE-2026-89965
Linux Kernel - Out of Bounds Write
Linux kernel contains a buffer overflow caused by improper validation of the nfree field in nvdimm/btt arenas, letting attackers trigger out-of-bounds writes by crafting arenas with nfree below lane count, exploit requires crafted or foreign arena.
- 7.8 /10 HighCVE-2026-89961 Auth required
Linux Kernel - Memory Management Logic Error
Linux kernel contains a logic error in powerpc/mm vmemmap population caused by incorrect addr_pfn tracking in compound pages, letting the system incorrectly map head/tail pages, exploit requires kernel-level access.