High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 4 of 725

  • 8.4 /10 High
    CVE-2026-58946 No auth

    Android ActivityClientController - Broken Access Control

    Android ActivityClientController contains a permission bypass caused by a logic error in navigateUpTo, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58944 No auth

    Android ActivityTaskManagerService - Privilege Escalation

    Android ActivityTaskManagerService contains a local privilege escalation caused by a confused deputy issue in moveTaskToFrontLocked, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58943 No auth

    AddAccountSettings.java - Privilege Escalation

    AddAccountSettings.java contains a confused deputy vulnerability causing background activity launch, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58942 No auth

    Memory - Use After Free

    Memory component contains a use after free caused by a logic error in do_fault_around, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58934 No auth

    WindowState - Permission Bypass

    WindowState.java contains a permission bypass caused by a logic error in prepareWindowToDisplayDuringRelayout, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58885 No auth

    Multiple Products - Broken Access Control

    Multiple locations contain a permission bypass caused by a confused deputy issue, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58884 No auth

    WifiServiceImpl - Broken Access Control

    WifiServiceImpl contains a permission bypass caused by a confused deputy in startTetheredHotspotRequest, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58873 No auth

    WindowManagerService - Broken Access Control

    WindowManagerService contains a permission bypass caused by missing permission check in addDragDropListener, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58866 No auth

    AccessibilityWindowManager - Privilege Escalation

    AccessibilityWindowManager contains a local privilege escalation caused by missing permission check in setAccessibilityWindowAttributes, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.5 /10 High
    CVE-2026-58853 No auth

    IPPHelper - Buffer Overflow

    IPPHelper contains a stack buffer overflow caused by missing bounds check in multiple functions, letting remote attackers cause denial of service, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58837 No auth

    Unknown - Privilege Escalation

    Unknown product contains a logic error causing possible background activity launch, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-58836 Auth required

    InstallPackageHelper - Broken Access Control

    InstallPackageHelper in handlePackagePostInstall contains an Enhanced Confirmation Mode bypass caused by a logic error allowing sideloaded applications to modify package source during self-update, letting local attackers escalate privileges, exploit requires user execution privileges.

  • 8.4 /10 High
    CVE-2026-58829 No auth

    Fuse - Privilege Escalation

    Fuse contains a use after free vulnerability in fuse_backing_mmap of backing.c, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58828 No auth

    base.c - Use After Free

    base.c contains a use-after-free caused by a race condition in multiple functions, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58827 No auth

    dma-buf - Use After Free

    dma-buf.c contains a use after free caused by a race condition in multiple functions, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.