High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 428 of 556

  • 8.5 /10 High
    CVE-2026-83267 Auth required

    Oracle BI Publisher - Broken Access Control

    Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contain an unauthorized access vulnerability caused by insufficient access control in BI Publisher Security, letting low privileged network attackers access and modify critical data, exploit requires network access via HTTP.

  • 8.2 /10 High
    CVE-2026-83266 No auth

    Oracle JDeveloper - Broken Access Control

    Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain an unauthorized access and partial denial of service vulnerability caused by improper access control in Resource Catalog Services, letting unauthenticated network attackers access critical data and cause partial DoS, exploit requires network access via HTTP.

  • 8.2 /10 High
    CVE-2026-83265 No auth

    Oracle Web Services Manager - Broken Access Control

    Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.0.0 contain an unauthorized access vulnerability caused by improper access control in Web Services Agent, letting unauthenticated network attackers access and modify critical data via HTTP.

  • 8.4 /10 High
    CVE-2026-83264 Auth required

    Oracle Product Lifecycle Analytics - Broken Access Control

    Oracle Product Lifecycle Analytics 3.6.1 contains a broken access control vulnerability caused by installation issues, letting low privileged logged-in attackers modify or access critical data, exploit requires attacker logon to infrastructure.

  • 7.5 /10 High
    CVE-2026-83263 Auth required

    Oracle Product Lifecycle Analytics - Authentication Bypass

    Oracle Product Lifecycle Analytics 3.6.1 contains a vulnerability caused by installation issues, letting low privileged attackers with network access via HTTP take over the product, exploit requires high attack complexity.

  • 7.5 /10 High
    CVE-2026-83262 Auth required

    Oracle Product Lifecycle Analytics - Authentication Bypass

    Oracle Product Lifecycle Analytics 3.6.1 contains a takeover vulnerability caused by installation issues, letting low privileged attackers with network access via HTTP compromise the product, exploit requires low privileges and network access.

  • 7.1 /10 High
    CVE-2026-83259 Auth required

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an unauthorized access and partial denial of service vulnerability caused by insufficient access controls in Forge component, letting low privileged attackers with network access via HTTP compromise critical data and cause partial DoS, exploit requires low privileged network access.

  • 8.1 /10 High
    CVE-2026-83258 No auth

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified issue in Forge component, letting unauthenticated attackers with network access via HTTP fully compromise the system, exploit requires high attack complexity.

  • 7.5 /10 High
    CVE-2026-83257 Auth required

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a takeover vulnerability caused by an unspecified issue in Forge component, letting low privileged attackers with network HTTP access compromise the system, exploit requires network access with low privileges.

  • 8.1 /10 High
    CVE-2026-83256 No auth

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified issue in Forge component, letting unauthenticated attackers with network access compromise the system, exploit requires high attack complexity.

  • 8.1 /10 High
    CVE-2026-83255 No auth

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified issue in Forge component, letting unauthenticated attackers with network access compromise the system, exploit requires high attack complexity.

  • 8.1 /10 High
    CVE-2026-83254 No auth

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified flaw in Forge component, letting unauthenticated attackers with network access compromise the system, exploit requires high attack complexity.

  • 7.8 /10 High
    CVE-2026-83253 No auth

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a takeover vulnerability caused by an easily exploitable issue in Endeca Application Controller, letting unauthenticated attackers with infrastructure access fully compromise the product, exploit requires human interaction from a user other than the attacker.

  • 7.0 /10 High
    CVE-2026-83252 No auth

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an unauthorized access vulnerability in Forge component, letting unauthenticated attackers with network access via HTTP gain unauthorized data access, modify data, and cause partial denial of service.

  • 7.8 /10 High
    CVE-2026-83249 Auth required

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a takeover vulnerability caused by an unspecified issue in Forge component, letting low privileged attackers with logon compromise the system, exploit requires local access with logon.