High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 429 of 556
- 8.2 /10 HighCVE-2026-83248 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Denial of Service & Information Disclosure
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a denial of service and information disclosure caused by unauthenticated network access via HTTP, letting attackers cause application crashes and read accessible data.
- 7.8 /10 HighCVE-2026-83247 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a takeover vulnerability caused by an easily exploitable flaw in the Forge component, letting unauthenticated attackers compromise the system, exploit requires human interaction from a user other than the attacker.
- 8.1 /10 HighCVE-2026-83246 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified flaw in Forge component, letting unauthenticated attackers with network access via HTTP fully compromise the system, exploit requires high attack complexity.
- 8.1 /10 HighCVE-2026-83245 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified issue in Forge component, letting unauthenticated attackers with network access via HTTP fully compromise the system, exploit requires high attack complexity.
- 7.1 /10 HighCVE-2026-83244
Oracle Commerce - Undefined
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an undefined vulnerability in Forge component, letting unauthenticated attackers with physical network access cause unauthorized data access, modification, or denial of service.
- 7.7 /10 HighCVE-2026-83243 Auth required
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an information disclosure vulnerability caused by improper access control, letting low privileged attackers with network access via HTTP gain unauthorized access to critical data, exploit requires low privileged network access.
- 7.3 /10 HighCVE-2026-83242 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an unauthorized access vulnerability caused by improper access control, letting unauthenticated attackers update, insert, delete, read data, and cause partial denial of service via HTTP network access.
- 7.5 /10 HighCVE-2026-83241 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a takeover vulnerability caused by an unspecified issue in Forge component, letting unauthenticated attackers with network access via HTTP and user interaction compromise the system.
- 7.1 /10 HighCVE-2026-83240 Auth required
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a broken access control vulnerability caused by insufficient privilege checks in Forge component, letting low privileged logged-in attackers modify critical data or cause denial of service.
- 7.0 /10 HighCVE-2026-83239 Auth required
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a vulnerability in Endeca Application Controller, letting low privileged attackers with logon compromise the product, exploit requires infrastructure logon.
- 7.1 /10 HighCVE-2026-83238 Auth required
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an unauthorized access and partial denial of service vulnerability caused by insufficient access controls in Forge component, letting low privileged attackers with network access via HTTP access critical data and cause partial service disruption.
- 7.1 /10 HighCVE-2026-83237 Auth required
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an unauthorized access and partial denial of service vulnerability caused by improper access control in Forge component, letting low privileged attackers with network access via HTTP compromise critical data and cause partial DoS, exploit requires low privileged network access.
- 8.2 /10 HighCVE-2026-83236 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a broken access control vulnerability caused by unauthenticated network access via HTTP, letting attackers gain unauthorized access and modify accessible data, exploit requires user interaction from a third party.
- 7.5 /10 HighCVE-2026-83235 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an unauthorized access vulnerability caused by improper access control, letting unauthenticated attackers with network access via HTTP access critical data, exploit requires network access.
- 8.2 /10 HighCVE-2026-83234 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an unauthorized access vulnerability caused by improper access control, letting unauthenticated attackers with network access via HTTP access and modify critical data, exploit requires network access.