High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 42 of 725
- 8.8 /10 HighCVE-2026-86396 Auth required
Dell PowerProtect Data Domain - Command Injection
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an OS command injection caused by improper neutralization of special elements, letting low privileged remote attackers execute arbitrary commands.
- 7.2 /10 HighCVE-2026-86395 Auth required
Dell PowerProtect Data Domain Virtual Edition - Command Injection
Dell PowerProtect Data Domain Virtual Edition 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands.
- 7.2 /10 HighCVE-2026-86394 Auth required
Dell PowerProtect Data Domain - Command Injection
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands.
- 7.2 /10 HighCVE-2026-86393 Auth required
Dell PowerProtect Data Domain - Privilege Escalation
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an improper privilege management vulnerability, letting high privileged remote attackers escalate privileges, exploit requires remote access with high privileges.
- 7.2 /10 HighCVE-2026-86389 Auth required
Dell PowerProtect Data Domain - Remote Code Execution
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an integer overflow caused by improper input handling, letting high privileged remote attackers execute code.
- 8.8 /10 HighCVE-2026-86385 Auth required
Dell PowerProtect Data Domain - Privilege Escalation
Dell PowerProtect Data Domain 7.7.1.0 through 8.8 contains an improper check for dropped privileges vulnerability, letting low privileged remote attackers escalate their privileges, exploit requires remote access with low privileges.
- 7.2 /10 HighCVE-2026-86380 Auth required
Dell PowerProtect Data Domain - Protection Mechanism Bypass
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an integer overflow or wraparound vulnerability, letting high privileged remote attackers bypass protection mechanisms, exploit requires high privileges.
- 7.2 /10 HighCVE-2026-86379 Auth required
Dell PowerProtect Data Domain Management Center - Command Injection
Dell PowerProtect Data Domain Management Center 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands.
- 8.8 /10 HighCVE-2026-86378 Auth required
Dell PowerProtect Data Domain - Buffer Overflow
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain a stack-based buffer overflow caused by improper bounds checking, letting low privileged remote attackers gain unauthorized access, exploit requires remote access with low privileges.
- 7.6 /10 HighCVE-2026-86377 Auth required
Dell PowerProtect Data Domain - Denial of Service
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an out-of-bounds write vulnerability, letting low privileged remote attackers cause denial of service, exploit requires remote access.
- 8.1 /10 HighCVE-2026-85749 Auth required
MailWatch for MailScanner - Broken Access Control
MailWatch for MailScanner < 1.2.27 contains a broken access control vulnerability caused by missing ownership checks in quarantine_action.php, letting authenticated users release or delete quarantined mails of others, exploit requires valid session and CSRF token.
- 8.1 /10 HighCVE-2026-84725 No auth
OpenJDK ORB - Remote Code Execution
OpenJDK ORB JDKBridge contains a remote code execution caused by honoring attacker-supplied CDR codebase URLs during object unmarshalling on port 3528, letting unauthenticated attackers load and instantiate arbitrary classes remotely before EJB security interceptors run.
- 7.8 /10 HighCVE-2026-82961 Auth required
Zephyr OS - Broken Access Control
Zephyr OS with CONFIG_USERSPACE=y contains a broken access control vulnerability caused by missing validation of GPIO pin arguments in gpio syscall handlers, letting user-mode threads with GPIO device access perform out-of-bounds kernel memory writes and reads, potentially leading to arbitrary code execution or kernel crash, exploit requires user-mode thread with GPIO device access.
- 8.8 /10 HighCVE-2026-78674 Auth required
BPMN System REST APIs - Command Injection
BPMN System REST APIs contain a command injection caused by insufficient input validation in REST API parameters, letting authenticated users execute arbitrary commands on the server, exploit requires user authentication.
- 8.6 /10 HighCVE-2026-76418 CISA KEVNo auth
Cisco Secure Firewall ASA & FTD - Denial of Service
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software contain a denial of service caused by logic errors in Remote Access SSL VPN secondary authentication, letting unauthenticated remote attackers cause device reloads, exploit requires crafted request to SSL VPN.