High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 411 of 556
- 7.8 /10 HighCVE-2026-87269 Auth required
Oracle VM VirtualBox - Privilege Escalation
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a privilege escalation vulnerability in the Core component, letting low privileged logged-in attackers take over the VirtualBox environment, exploit requires local login.
- 7.8 /10 HighCVE-2026-87268 Auth required
Oracle VM VirtualBox - Privilege Escalation
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a privilege escalation vulnerability in the Core component, letting low privileged logged-in attackers take over the system, exploit requires local access.
- 8.2 /10 HighCVE-2026-87266 No auth
Oracle Agile PLM - Broken Access Control
Oracle Agile PLM 9.3.6 contains an unauthorized access and partial denial of service vulnerability caused by insufficient access control in Application Server, letting unauthenticated attackers with network access via HTTP compromise critical data and cause partial DoS.
- 8.1 /10 HighCVE-2026-87265 Auth required
Oracle E-Business Suite Oracle Purchasing - Broken Access Control
Oracle E-Business Suite Oracle Purchasing 12.2.3-12.2.15 contains an unauthorized data access and modification vulnerability caused by insufficient access controls, letting low privileged attackers with network access via HTTP modify or access critical data.
- 7.7 /10 HighCVE-2026-87264 Auth required
Oracle PeopleSoft PeopleTools - Broken Access Control
Oracle PeopleSoft PeopleTools 8.61-8.63 contains an integrity-impacting vulnerability in Integration Broker, letting low privileged attackers with network HTTP access modify critical data, exploit requires low privilege network access.
- 7.1 /10 HighCVE-2026-87262
Oracle Agile Engineering Data Management - Broken Access Control
Oracle Agile Engineering Data Management 6.2.1 contains an unauthorized access vulnerability caused by physical communication segment access in Engineering Communication Interface, letting unauthenticated attackers access and modify critical data, exploit requires physical access to communication segment.
- 7.3 /10 HighCVE-2026-87261 Auth required
Oracle Agile Engineering Data Management - Broken Access Control
Oracle Agile Engineering Data Management 6.2.1 contains a broken access control vulnerability in Engineering Communication Interface, letting low privileged logged-in attackers gain unauthorized access and modify data, exploit requires user login.
- 7.3 /10 HighCVE-2026-87260
Oracle Agile Engineering Data Management - Broken Access Control
Oracle Agile Engineering Data Management 6.2.1 contains a broken access control vulnerability caused by insufficient protection of the physical communication segment, letting low privileged attackers with physical access create, delete, or modify critical data.
- 8.4 /10 HighCVE-2026-87259 Auth required
Oracle Agile Engineering Data Management - Broken Access Control
Oracle Agile Engineering Data Management 6.2.1 contains a broken access control vulnerability caused by insufficient privilege checks in Engineering Communication Interface, letting low privileged logged-in attackers create, delete, or modify critical data, exploit requires attacker login.
- 7.6 /10 HighCVE-2026-87258 Auth required
Oracle Agile PLM - Broken Access Control
Oracle Agile PLM 9.3.6 contains an access control vulnerability in Folders, Files & Attachments, letting low privileged attackers with network access via HTTP and user interaction gain unauthorized access and modify data.
- 7.7 /10 HighCVE-2026-87257 Auth required
Oracle Agile PLM - Broken Access Control
Oracle Agile PLM 9.3.6 contains an unauthorized access vulnerability in the SDK component, letting low privileged attackers with network access via HTTP compromise critical data, exploit requires low privileges.
- 7.7 /10 HighCVE-2026-87256 Auth required
Oracle Agile PLM - Broken Access Control
Oracle Agile PLM 9.3.6 contains an unauthorized access vulnerability caused by insufficient access controls in the Application Server, letting low privileged attackers with network access via HTTP access critical data, exploit requires low privileges.
- 7.5 /10 HighCVE-2026-87254 Auth required
Oracle Agile PLM - Authentication Bypass
Oracle Agile PLM 9.3.6 contains a vulnerability in Folders, Files & Attachments component, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges and network access.
- 7.6 /10 HighCVE-2026-87250 Auth required
Oracle Hyperion Financial Management - Broken Access Control
Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized access vulnerability caused by insufficient access control in the Security component, letting low privileged attackers with network access via HTTP gain unauthorized data access and modification, exploit requires user interaction from a different person.
- 7.1 /10 HighCVE-2026-87249 No auth
Oracle Hyperion Financial Management - Broken Access Control
Oracle Hyperion Financial Management 11.2.26.0.000 contains a broken access control vulnerability caused by unauthenticated network access via HTTP, letting attackers modify critical data and cause partial denial of service, exploit requires user interaction.