High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 410 of 556

  • 7.5 /10 High
    CVE-2026-88975 No auth

    Http4s - Denial of Service

    Http4s prior to 0.23.37 and 1.0.0-M48 contains a denial of service caused by improper HTTP/2 frame size validation in Ember's read loop, letting unauthenticated peers cause memory amplification, exploit requires network access.

  • 8.5 /10 High
    CVE-2026-88765 Auth required

    GitLab EE - Remote Code Execution

    GitLab EE 12.3 to 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2 contain a remote code execution caused by Unicode conversion buffer overflow in Advanced Search indexing when importing crafted Git project exports, letting authenticated users execute code remotely, exploit requires user authentication.

  • 8.1 /10 High
    CVE-2026-88619 Auth required

    1024-lab SmartAdmin - Broken Access Control

    1024-lab SmartAdmin v3.30.0 contains a broken access control vulnerability caused by missing method-level permission checks in the scheduled-job management module, letting low-privileged authenticated users access admin functionality.

  • 8.8 /10 High
    CVE-2026-88616 Auth required

    RuoYi-Vue-Plus - Remote Code Execution

    RuoYi-Vue-Plus 6.0.0 contains a remote code execution caused by improper handling in FlwTaskController.java and related workflow task components, letting remote attackers execute arbitrary code, exploit requires crafted POST request.

  • 7.5 /10 High
    CVE-2026-88065 No auth

    tts-be - Broken Access Control

    tts-be < 2.1.0 contains a broken access control vulnerability across multiple unauthenticated API endpoints, letting remote attackers bypass authorization to enumerate and extract sensitive PII, exploit requires chaining unauthenticated endpoints.

  • 7.5 /10 High
    CVE-2026-87289 No auth

    Oracle Fusion Middleware Helidon - Denial of Service

    Oracle Fusion Middleware Helidon 4.0.0-4.5.4 contains a denial of service caused by improper handling in helidon-webserver-static-content, letting unauthenticated attackers with network access via HTTP cause service hang or crash, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-87288 No auth

    Oracle GraalVM - Remote Code Execution

    Oracle GraalVM 25.0.4.1 contains a remote code execution caused by a vulnerability in the Compiler component, letting unauthenticated attackers with network access via HTTP take over the system, exploit requires high attack complexity.

  • 8.1 /10 High
    CVE-2026-87287 No auth

    Oracle GraalVM - Remote Code Execution

    Oracle GraalVM 25.0.4.1 contains a remote code execution vulnerability caused by an unspecified issue in the Compiler component, letting unauthenticated network attackers take over the system, exploit requires high attack complexity.

  • 8.1 /10 High
    CVE-2026-87286 No auth

    Oracle GraalVM - Remote Code Execution

    Oracle GraalVM 25.0.4.1 contains a remote code execution vulnerability caused by an unspecified issue in the Compiler component, letting unauthenticated network attackers take over the system, exploit requires high attack complexity.

  • 7.5 /10 High
    CVE-2026-87277

    Oracle VM VirtualBox - Denial of Service

    Oracle VM VirtualBox 7.2.16 contains a denial of service caused by improper handling in the Core component, letting unauthenticated attackers with network access via RDP cause a hang or crash, exploit requires network access via RDP.

  • 7.5 /10 High
    CVE-2026-87276 Auth required

    Oracle VM VirtualBox - Privilege Escalation

    Oracle VM VirtualBox 7.2.16 contains a privilege escalation vulnerability caused by a core component flaw, letting low privileged logged-in attackers with user interaction takeover the system, exploit requires user interaction from a different person.

  • 8.6 /10 High
    CVE-2026-87273 No auth

    Oracle VM VirtualBox - Remote Code Execution

    Oracle VM VirtualBox 7.2.16 contains a remote code execution caused by a vulnerability in the core component, letting unauthenticated attackers with infrastructure logon and user interaction take over the system, exploit requires user interaction from a different person.

  • 7.8 /10 High
    CVE-2026-87272 Auth required

    Oracle VM VirtualBox - Privilege Escalation

    Oracle VM VirtualBox 7.2.16 contains a privilege escalation vulnerability in the Core component, letting low privileged logged-in attackers take over Oracle VM VirtualBox, exploit requires attacker login.

  • 7.8 /10 High
    CVE-2026-87271 Auth required

    Oracle VM VirtualBox - Complete System Takeover

    Oracle VM VirtualBox 7.2.16 on Windows hosts contains a vulnerability in the Core component, letting low privileged logged-in attackers fully compromise the system, exploit requires attacker logon to the host.

  • 7.8 /10 High
    CVE-2026-87270 Auth required

    Oracle VM VirtualBox - Privilege Escalation

    Oracle VM VirtualBox 7.2.16 on Windows hosts contains a privilege escalation vulnerability in the Core component, letting low privileged logged-in attackers take over the VirtualBox environment, exploit requires local login.