High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 434 of 556

  • 8.8 /10 High
    CVE-2026-83164 Auth required

    Oracle Customer Interaction History - Remote Code Execution

    Oracle Customer Interaction History 12.2.3-12.2.15 contains a remote code execution caused by an easily exploitable vulnerability in Outcome-Result component, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges.

  • 8.8 /10 High
    CVE-2026-83163 Auth required

    Oracle Application Object Library - Remote Code Execution

    Oracle Application Object Library 12.2.3-12.2.15 contains a remote code execution caused by improper handling in Attachments / File Upload component, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges.

  • 7.4 /10 High
    CVE-2026-83162 No auth

    Oracle Application Object Library - Broken Access Control

    Oracle Application Object Library 12.2.3-12.2.15 contains a broken access control vulnerability caused by improper authorization checks, letting unauthenticated attackers with network access via HTTPS modify or access critical data, exploit requires network access via HTTPS.

  • 7.1 /10 High
    CVE-2026-83161 Auth required

    Oracle Project Intelligence - Broken Access Control

    Oracle Project Intelligence 12.2.3-12.2.15 contains a broken access control vulnerability caused by insufficient authorization checks in internal operations, letting low privileged attackers with network access via HTTP create, delete, modify, or read critical data.

  • 8.8 /10 High
    CVE-2026-83160 Auth required

    Oracle Database Server - Remote Code Execution

    Oracle Database Server 23.4.0-23.26.3 contains a remote code execution caused by a vulnerability in the RDBMS component, letting low privileged attackers with Create Table privilege and network access via Oracle Net take over the RDBMS, exploit requires Create Table privilege.

  • 7.8 /10 High
    CVE-2026-83159 No auth

    Oracle E-Business Suite Applications DBA - Privilege Escalation

    Oracle E-Business Suite Applications DBA 12.2.3-12.2.15 contains a privilege escalation caused by unauthenticated attacker interaction with ADPatch component, letting attackers take over Applications DBA, exploit requires human interaction.

  • 7.1 /10 High
    CVE-2026-83158 Auth required

    Oracle Oracle Applications Manager - Broken Access Control

    Oracle E-Business Suite Oracle Applications Manager 12.2.3-12.2.15 contains a broken access control vulnerability in Command Line - RapidClone, letting low privileged attackers with logon compromise data integrity and confidentiality, exploit requires attacker logon to infrastructure.

  • 8.0 /10 High
    CVE-2026-83157 Auth required

    Oracle Oracle Applications Manager - Command Injection

    Oracle E-Business Suite Oracle Applications Manager 12.2.3-12.2.15 contains a command injection caused by vulnerability in Command Line - RapidClone component, letting high privileged attackers with network access via HTTP takeover Oracle Applications Manager, exploit requires high privileges.

  • 7.5 /10 High
    CVE-2026-83156 Auth required

    Oracle XML Developers Kit - Broken Access Control

    Oracle XML Developers Kit in Oracle Database Server 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 contains a vulnerability caused by improper access control, letting low privileged attackers with XDKC privilege and network access via Oracle Net take over the component, exploit requires XDKC privilege.

  • 7.3 /10 High
    CVE-2026-83155

    Oracle Siebel CRM Deployment - Broken Access Control

    Oracle Siebel CRM Deployment 17.0-26.7 contains an unauthorized access and denial of service vulnerability caused by insufficient protection of physical communication segment, letting low privileged attackers with physical network access compromise data confidentiality and availability, exploit requires physical network access.

  • 8.8 /10 High
    CVE-2026-83153 Auth required

    Oracle Siebel CRM Deployment - Remote Code Execution

    Oracle Siebel CRM Deployment 17.0-26.7 contains a remote code execution caused by a vulnerability in Server Infrastructure, letting low privileged attackers with network access via HTTPS take over the system, exploit requires low privileges.

  • 8.1 /10 High
    CVE-2026-83152 Auth required

    Oracle Project Intelligence - Broken Access Control

    Oracle Project Intelligence 12.2.3-12.2.15 contains a broken access control vulnerability caused by insufficient privilege checks in internal operations, letting low privileged attackers with network access via HTTP modify or access critical data.

  • 7.0 /10 High
    CVE-2026-83150 No auth

    Oracle Application Testing Suite - Authentication Bypass

    Oracle Application Testing Suite 13.3.0.1 contains a takeover vulnerability caused by an unauthenticated attacker with infrastructure logon and required human interaction, letting attackers compromise the suite.

  • 8.8 /10 High
    CVE-2026-83148 Auth required

    Oracle Application Testing Suite - Authentication Bypass

    Oracle Application Testing Suite 13.3.0.1 contains a takeover vulnerability caused by insufficient privilege restrictions, letting low privileged attackers with Test Manager for Web Apps privilege compromise the system remotely via HTTP, exploit requires network access and specific privileges.

  • 7.8 /10 High
    CVE-2026-83147 Auth required

    Oracle PeopleSoft PeopleSoft Enterprise FIN Inventory Brazil - Privilege Escalation

    Oracle PeopleSoft PeopleSoft Enterprise FIN Inventory Brazil 9.1 contains a privilege escalation vulnerability in Inventory component, letting low privileged logged-in attackers take over the system, exploit requires attacker login.