High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 419 of 556
- 7.1 /10 HighCVE-2026-87126 Auth required
Oracle Oracle Report Manager - Broken Access Control
Oracle E-Business Suite Oracle Report Manager 12.2.3-12.2.15 contains an unauthorized access vulnerability in Reports Security, letting low privileged attackers with network access via HTTP access critical data and cause partial denial of service, exploit requires low privileged network access.
- 8.3 /10 HighCVE-2026-87125 Auth required
Oracle Financials for Asia/Pacific - Broken Access Control
Oracle Financials for Asia/Pacific 12.2.8-12.2.15 contains a broken access control vulnerability caused by improper authorization in Internal Operations, letting low privileged attackers with network access via HTTP create, modify, delete critical data, or cause partial denial of service.
- 7.7 /10 HighCVE-2026-87124 Auth required
Oracle iRecruitment - Broken Access Control
Oracle iRecruitment 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access control in Internal Operations, letting low privileged attackers with network access via HTTP access critical data, exploit requires low privileges.
- 8.8 /10 HighCVE-2026-85893 No auth
Microsoft Edge - Privilege Escalation
Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows an unauthorized attacker to elevate privileges over a network, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-85234 No auth
tftp-hpa - Denial of Service
tftp-hpa contains an out-of-bounds read/write vulnerability caused by invalid match offsets passed to genmatchstring() in the in.tftpd remap engine when processing inverse remap rules with custom error messages, letting remote unauthenticated attackers cause denial of service.
- 7.3 /10 HighCVE-2026-85013 Auth required
environment-modules - Command Injection
environment-modules contains a command injection caused by evaluation of maliciously named modulefiles during Bash completion of module commands, letting local attackers execute arbitrary commands, exploit requires attacker to place malicious modulefile in MODULEPATH.
- 8.5 /10 HighCVE-2026-83490 Auth required
Oracle iRecruitment - Broken Access Control
Oracle iRecruitment 12.2.3-12.2.15 contains an unauthorized access and data modification vulnerability caused by insufficient access controls in Internal Operations, letting low privileged attackers with network access via HTTP compromise critical data, exploit requires low privileged network access.
- 7.5 /10 HighCVE-2026-83489 Auth required
Oracle Banking Origination - Authentication Bypass
Oracle Banking Origination 14.5.0.0.0-14.9.0.0.0 contains a vulnerability in Onboarding Batch Processes, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges and network access.
- 7.7 /10 HighCVE-2026-83487 Auth required
Oracle Product Hub - Broken Access Control
Oracle Product Hub 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access controls in Item Catalog, letting low privileged attackers with network access via HTTP access critical data, exploit requires low privileges.
- 7.7 /10 HighCVE-2026-83486 Auth required
Oracle Product Hub - Broken Access Control
Oracle Product Hub 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access controls in Item Catalog, letting low privileged attackers with network access via HTTP access critical data, exploit requires low privileges.
- 7.7 /10 HighCVE-2026-83485 Auth required
Oracle Product Hub - Broken Access Control
Oracle Product Hub 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access control in Item Catalog, letting low privileged attackers with network access via HTTP access critical data, exploit requires low privileges.
- 7.1 /10 HighCVE-2026-83484 Auth required
Oracle US Federal Human Resources - Broken Access Control
Oracle US Federal Human Resources 12.2.3-12.2.15 contains a broken access control vulnerability caused by insufficient privilege checks in internal operations, letting low privileged attackers with network access via HTTP modify and read critical data.
- 8.0 /10 HighCVE-2026-83483 Auth required
Oracle Advanced Benefits - Authentication Bypass
Oracle Advanced Benefits 12.2.3-12.2.15 contains a takeover vulnerability caused by an unspecified issue in Self-serv What-if Analysis, letting high privileged attackers with network access via HTTP compromise the product and impact additional products, exploit requires high privileges.
- 7.2 /10 HighCVE-2026-83482 Auth required
Oracle E-Business Suite Oracle Contracts - Authentication Bypass
Oracle E-Business Suite Oracle Contracts 12.2.14-12.2.15 contains a vulnerability in Internal Operations, letting high privileged attackers with network access via HTTP take over the product, exploit requires high privileges.
- 7.2 /10 HighCVE-2026-83481 Auth required
Oracle E-Business Suite Oracle Contracts - Remote Code Execution
Oracle E-Business Suite Oracle Contracts 12.2.14-12.2.15 contains a remote code execution caused by an easily exploitable vulnerability in Internal Operations, letting high privileged attackers with network access via HTTP take over the product, exploit requires high privileges.