High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 416 of 556

  • 8.8 /10 High
    CVE-2026-87179 Auth required

    Oracle Hyperion Financial Management - Authentication Bypass

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a security vulnerability caused by insufficient access control, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges.

  • 8.7 /10 High
    CVE-2026-87178 Auth required

    Oracle Hyperion Financial Management - SQL Injection

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a SQL injection caused by insufficient input validation in the Security component, letting high privileged attackers with network access compromise data integrity and confidentiality, exploit requires high privileges.

  • 8.5 /10 High
    CVE-2026-87177 Auth required

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized access vulnerability caused by insufficient access controls in the Security component, letting low privileged attackers with network access via HTTP gain unauthorized read and write access, exploit requires low privileged network access.

  • 8.2 /10 High
    CVE-2026-87174 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized access vulnerability caused by insufficient access controls in the Security component, letting unauthenticated network attackers access and modify critical data remotely, exploit requires network access via TCP.

  • 8.7 /10 High
    CVE-2026-87171 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a broken access control vulnerability in Security component, letting unauthenticated attackers with network access via HTTPS create, delete, or modify critical data, exploit requires network access with high complexity.

  • 8.1 /10 High
    CVE-2026-87168 Auth required

    Oracle Oracle Purchasing - Broken Access Control

    Oracle E-Business Suite Oracle Purchasing 12.2.10-12.2.15 contains a broken access control vulnerability caused by insufficient privilege checks in G-Invoicing component, letting low privileged attackers with network access via HTTP create, delete, or modify critical data, exploit requires low privileged network access.

  • 8.1 /10 High
    CVE-2026-87167 Auth required

    Oracle Purchasing - Broken Access Control

    Oracle E-Business Suite Oracle Purchasing 12.2.11-12.2.15 contains a broken access control vulnerability caused by insufficient privilege checks in G-Invoicing component, letting low privileged attackers with network access via HTTP create, delete, or modify critical data, exploit requires low privileged network access.

  • 8.1 /10 High
    CVE-2026-87166 Auth required

    Oracle E-Business Suite Oracle Purchasing - Broken Access Control

    Oracle E-Business Suite Oracle Purchasing 12.2.3-12.2.15 contains an unauthorized data modification and access vulnerability caused by insufficient access controls, letting low privileged attackers with network access via HTTP modify or access critical data.

  • 8.8 /10 High
    CVE-2026-87165 Auth required

    Oracle Contract Lifecycle Management for Public Sector - Remote Code Execution

    Oracle Contract Lifecycle Management for Public Sector V16 contains a remote code execution vulnerability caused by an easily exploitable flaw in ECC For Award and IDV component, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges.

  • 8.0 /10 High
    CVE-2026-87164 Auth required

    Oracle Banking Branch - Authentication Bypass

    Oracle Banking Branch 14.5.0.0.0-14.9.0.0.0 contains an undefined vulnerability in Reports component, letting low privileged attackers with network access via HTTP and user interaction take over the system, exploit requires human interaction.

  • 8.8 /10 High
    CVE-2026-87163 Auth required

    Oracle E-Business Suite Oracle Purchasing - Authentication Bypass

    Oracle E-Business Suite Oracle Purchasing 12.2.3-12.2.15 contains a critical vulnerability caused by an unspecified issue in the component, letting low privileged attackers with network access via HTTP take over Oracle Purchasing, exploit requires low privileges.

  • 8.8 /10 High
    CVE-2026-87162 Auth required

    Oracle Contract Lifecycle Management for Public Sector - Remote Code Execution

    Oracle Contract Lifecycle Management for Public Sector 12.2.13-12.2.15 contains a remote code execution caused by an easily exploitable vulnerability in Award/PO component, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges and network access.

  • 8.5 /10 High
    CVE-2026-87161 Auth required

    Oracle Oracle HRMS (India) - Broken Access Control

    Oracle E-Business Suite Oracle HRMS (India) 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access controls in Internal Operations, letting low privileged attackers with network access via HTTP access and modify critical data, exploit requires low privileged network access.

  • 7.1 /10 High
    CVE-2026-87160 Auth required

    Oracle E-Business Suite Oracle HRMS - Broken Access Control

    Oracle E-Business Suite Oracle HRMS (India) 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access controls in Internal Operations, letting low privileged attackers with network access via HTTPS access and modify critical data, exploit requires low privileged network access.

  • 8.1 /10 High
    CVE-2026-87159 Auth required

    Oracle Oracle HRMS (India) - Broken Access Control

    Oracle E-Business Suite Oracle HRMS (India) 12.2.3-12.2.15 contains a broken access control vulnerability caused by insufficient privilege checks in Internal Operations, letting low privileged attackers with network access via HTTP create, delete, or modify critical data, exploit requires low privileged network access.