High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 422 of 556

  • 8.1 /10 High
    CVE-2026-83428 Auth required

    Oracle Demand Signal Repository - Broken Access Control

    Oracle Demand Signal Repository 12.2.3-12.2.15 contains a broken access control vulnerability caused by insufficient privilege checks in Internal Operations, letting low privileged attackers with network access via HTTP modify or access critical data.

  • 8.5 /10 High
    CVE-2026-83425 Auth required

    Oracle Oracle Complex Maintenance, Repair and Overhaul - Broken Access Control

    Oracle E-Business Suite Oracle Complex Maintenance, Repair and Overhaul 12.2.12-12.2.15 contains an unauthorized access and partial denial of service vulnerability caused by insufficient access controls in Internal Operations, letting low privileged attackers with network access via HTTP compromise critical data and cause partial service disruption, exploit requires low privileged network access.

  • 7.5 /10 High
    CVE-2026-83424 No auth

    Oracle JDeveloper - Information Disclosure

    Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain an information disclosure vulnerability caused by unauthenticated network access via HTTP, letting attackers access critical or all accessible data remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-83423 Auth required

    Oracle JDeveloper - Remote Code Execution

    Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution vulnerability caused by security framework flaws, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges and network access.

  • 8.1 /10 High
    CVE-2026-83422 No auth

    Oracle Identity Manager - Broken Access Control

    Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 contain a broken access control vulnerability in OIM Legacy UI, letting unauthenticated attackers with network access via HTTP create, delete, or modify critical data, exploit requires user interaction from a different person.

  • 7.8 /10 High
    CVE-2026-83420 Auth required

    Oracle PeopleSoft PeopleSoft Enterprise FIN Engineering Brazil - Privilege Escalation

    Oracle PeopleSoft PeopleSoft Enterprise FIN Engineering Brazil 9.1 contains a privilege escalation vulnerability in Engineering component, letting low privileged logged-in attackers take over the system, exploit requires attacker login.

  • 8.2 /10 High
    CVE-2026-83418 Auth required

    Oracle Communications Cloud Native Core Security Edge Protection Proxy - Broken Access Control

    Oracle Communications Cloud Native Core Security Edge Protection Proxy 26.1.200 and 25.2.201 contains a broken access control vulnerability caused by improper authorization in SEPP component, letting low privileged attackers with network HTTP access create, delete, or modify critical data, exploit requires network access with low privileges.

  • 7.1 /10 High
    CVE-2026-83417

    Oracle Communications Cloud Native Core Security Edge Protection Proxy - Broken Access Control

    Oracle Communications Cloud Native Core Security Edge Protection Proxy 26.1.200 and 25.2.201 contain an unauthorized access vulnerability caused by unauthenticated attacker access to the physical communication segment, letting attackers access and modify critical data, exploit requires physical network access.

  • 7.5 /10 High
    CVE-2026-83415 Auth required

    Oracle Coherence - Remote Code Execution

    Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a remote code execution caused by a vulnerability in the core component, letting low privileged attackers with network access via HTTP take over the system, exploit requires network access with low privileges.

  • 8.1 /10 High
    CVE-2026-83412 Auth required

    Oracle Coherence - Broken Access Control

    Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain an unauthorized data access and modification vulnerability caused by insufficient access controls in the core component, letting low privileged network attackers create, delete, or modify critical data without user interaction.

  • 8.8 /10 High
    CVE-2026-83411 Auth required

    Oracle Coherence - Remote Code Execution

    Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a remote code execution caused by a vulnerability in the core component, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileged network access.

  • 8.8 /10 High
    CVE-2026-83410 Auth required

    Oracle Coherence - Remote Code Execution

    Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a remote code execution caused by easily exploitable vulnerability in the core component, letting low privileged attackers with network access take over the system, exploit requires network access with low privileges.

  • 8.1 /10 High
    CVE-2026-83408 No auth

    Oracle GraalVM - Remote Code Execution

    Oracle GraalVM for JDK 17 23.0.13.1, JDK 21 23.1.12.1, and GraalVM 25.0.4.1 contain a remote code execution caused by a vulnerability in the Compiler component, letting unauthenticated attackers with network HTTP access take over the system, exploit requires high attack complexity.

  • 7.0 /10 High
    CVE-2026-83368 No auth

    Oracle GraalVM - Broken Access Control

    Oracle GraalVM for JDK 17 23.0.13.1, JDK 21 23.1.12.1, GraalVM Enterprise Edition 21.3.19.1, and GraalVM 25.0.4.1 contain an unauthorized access vulnerability caused by a flaw in the Compiler component, letting unauthenticated network attackers access and partially disrupt data, exploit requires network access via HTTP with high complexity.

  • 8.1 /10 High
    CVE-2026-83357 No auth

    Oracle GraalVM for JDK - Remote Code Execution

    Oracle GraalVM for JDK 17 23.0.13.1, JDK 21 23.1.12.1, and GraalVM 25.0.4.1 contain a remote code execution caused by a vulnerability in the Compiler component, letting unauthenticated attackers with network HTTP access take over the system, exploit requires high attack complexity.