High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 403 of 568
- 7.8 /10 HighCVE-2026-89823 Auth required
Linux Kernel drm - Race Condition
Linux kernel contains a race condition in drm_dev_register() caused by improper synchronization between partial device registration failure and ioctl handling, letting local userspace attackers cause resource teardown during ioctl, exploit requires userspace to open device minor.
- 7.8 /10 HighCVE-2026-89819 Auth required
Linux Kernel - Out-of-Bounds Read & Denial of Service
Linux kernel drm/amd/display contains an out-of-bounds read and divide-by-zero vulnerability caused by lack of validation of plane degamma LUT size in __set_dm_plane_degamma, letting attackers trigger memory corruption, exploit requires malformed AMD_PLANE_DEGAMMA_LUT input.
- 7.1 /10 HighCVE-2026-89818
Linux Kernel drm/amdgpu/vcn - Integer Overflow
Linux kernel drm/amdgpu/vcn contains an integer overflow caused by improper dec_msg buffer count check, letting attackers bypass bounds check and cause out-of-bounds access, exploit requires ~4GiB mapping.
- 7.8 /10 HighCVE-2026-89815 Auth required
Linux Kernel drm/ttm - Use After Free
Linux kernel drm/ttm contains a use-after-free vulnerability caused by not dropping tt->restore after successful restore in ttm_pool_restore_and_alloc(), letting attackers cause system instability or crashes, exploit requires kernel-level access.
- 7.8 /10 HighCVE-2026-89814 Auth required
Linux Kernel - Out of Bounds Read/Write
Linux kernel contains an out-of-bounds array access vulnerability in drm/amdgpu caused by improper indexing of isolation array for rings outside a partition, letting attackers cause kernel crashes or undefined behavior, exploit requires crafted SDMA submissions.
- 8.8 /10 HighCVE-2026-89811 Auth required
Linux Kernel drm/amdkfd - Race Condition
Linux kernel drm/amdkfd contains a race condition caused by missing TLB flush after MES queue eviction/suspension, letting attackers cause GPU queue hangs and page faults during SVM page migration, exploit requires specific hardware and XNACK mode enabled.
- 7.8 /10 HighCVE-2026-89810
Linux Kernel drm/amdkfd - Memory Management Error
Linux kernel drm/amdkfd contains a memory management error caused by incorrect use of DMA address instead of physical page frame number during page migration, letting the driver fail to release and unlock system pages properly, exploit requires specific page migration failure conditions.
- 7.8 /10 HighCVE-2026-89808 Auth required
Linux Kernel drm/amdkfd - Memory Management Vulnerability
Linux kernel drm/amdkfd contains a memory management vulnerability caused by uninitialized variable usage during vm range migration in svm_migrate_copy_to_vram, letting attackers trigger VRAM corruption, exploit requires specific vm range conditions.
- 8.4 /10 HighCVE-2026-89806 No auth
Linux Kernel drm/sysfb ofdrm - Integer Overflow
Linux kernel drm/sysfb ofdrm contains an integer overflow caused by unchecked multiplication of linebytes and height in framebuffer size calculation, letting attackers cause undefined behavior or potential denial of service, exploit requires crafted input triggering large framebuffer sizes.
- 7.8 /10 HighCVE-2026-89805 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free and allocation fallback issue in drm_pagemap_migrate_populate_ram_pfn() caused by improper handling of higher-order folio allocations and reference counting, letting attackers cause kernel instability or denial of service, exploit requires kernel-level access.
- 8.8 /10 HighCVE-2026-89804 Auth required
Linux Kernel - Resource Leak
Linux kernel contains a mismatched DMA unmap size vulnerability in drm/nouveau/dmem caused by incorrect unmap size for large folios, letting attackers cause resource leaks, exploit requires kernel-level access.
- 7.8 /10 HighCVE-2026-89803
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in drm/nouveau caused by improper ordering of channel-kill event unsubscription and fence context teardown, letting attackers cause a kernel crash or denial of service, exploit requires precise timing during channel destruction.
- 7.8 /10 HighCVE-2026-89801 Auth required
Linux kernel drm/nouveau/uvmm - Use After Free
Linux kernel drm/nouveau/uvmm contains a use-after-free caused by premature region free on failed OP_UNMAP_SPARSE in nouveau_uvmm_bind_job_submit(), letting attackers cause memory corruption, exploit requires triggering drm_gpuvm_sm_unmap_ops_create() failure.
- 7.8 /10 HighCVE-2026-89799 Auth required
Linux Kernel - Race Condition
Linux kernel contains a race condition caused by improper preemption handling in bpf_get_stackid, letting attackers cause denial of service or system instability, exploit requires kernel-level access.
- 8.4 /10 HighCVE-2026-89795
CVE-2026-89795
In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, which use a machine level hypervisor, PCI devices are always accessed through a form of PCI pass-through which fundamentally operates on a per PCI function granularity. This is also reflected in the s390 PCI hotplug driver which creates hotplug slots for individual PCI functions. Its reset_slot() function, which is a wrapper for zpci_hot_reset_device(), thus also resets individual functions. Currently, the pci_create_slot() assigns the same pci_slot object to multifunction devices. This approach worked fine on s390 systems that only exposed virtual functions as individual PCI domains to the operating system. Since commit 44510d6fa0c0 ("s390/pci: Handling multifunctions") s390 supports exposing the topology of multifunction PCI devices by grouping them in a shared PCI domain. This creates a problem when resetting a function through the hotplug driver's slot_reset() interface. When attempting to reset a function through the hotplug driver, the shared slot assignment causes the wrong function to be reset instead of the intended one. It also leaks memory as we do create a pci_slot object for the function, but don't correctly free it in pci_slot_release(). Add a flag for struct pci_slot to allow per function PCI slots for functions managed through a hypervisor, which exposes individual PCI functions while retaining the topology. Since we can use all 8 bits for slot 'number' (for ARI devices), change slot 'number' u16 to account for special values PCI_SLOT_PLACEHOLDER and PCI_SLOT_ALL_DEVICES.