High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 440 of 556

  • 7.1 /10 High
    CVE-2026-83044 Auth required

    Oracle Oracle XML Gateway - Broken Access Control

    Oracle E-Business Suite Oracle XML Gateway 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access controls in Install component, letting low privileged attackers with network access via HTTP access critical data and cause partial denial of service, exploit requires low privileges.

  • 7.7 /10 High
    CVE-2026-83041 Auth required

    Oracle WebCenter Portal - Broken Access Control

    Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contains an unauthorized access vulnerability caused by insufficient access control in Portlet Services, letting low privileged attackers with network access via HTTP access critical data, exploit requires low privileges.

  • 7.5 /10 High
    CVE-2026-83034 No auth

    Oracle WebCenter Sites - Broken Access Control

    Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain an unauthorized access vulnerability caused by improper access control, letting unauthenticated network attackers access critical data, exploit requires network access via HTTP.

  • 8.8 /10 High
    CVE-2026-83033 Auth required

    Oracle WebCenter Sites - Remote Code Execution

    Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by an easily exploitable vulnerability accessible via HTTP, letting low privileged attackers with network access fully compromise the system, exploit requires low privileges.

  • 8.8 /10 High
    CVE-2026-83032 Auth required

    Oracle WebCenter Sites - Remote Code Execution

    Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by an easily exploitable vulnerability accessible via HTTP, letting low privileged attackers take over the system, exploit requires network access and low privileges.

  • 8.3 /10 High
    CVE-2026-83030 Auth required

    Oracle Managed File Transfer - Broken Access Control

    Oracle Managed File Transfer 12.2.1.4.0 and 14.1.2.0.0 contain an access control vulnerability in MFT Runtime Server, letting low privileged attackers with network access via T3, IIOP create, delete, modify, read data, or cause denial of service.

  • 7.5 /10 High
    CVE-2026-83028

    Oracle Identity Manager Connector - Authentication Bypass

    Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 contains a takeover vulnerability caused by unauthorized access to the physical communication segment, letting unauthenticated attackers compromise the connector, exploit requires physical network access.

  • 8.3 /10 High
    CVE-2026-83026

    Oracle Identity Manager Connector - Authentication Bypass

    Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 contain a takeover vulnerability caused by access to the physical communication segment attached to the hardware, letting unauthenticated attackers compromise the connector, exploit requires physical network access.

  • 8.7 /10 High
    CVE-2026-83025 No auth

    Oracle Oracle Identity Manager Connector - Broken Access Control

    Oracle Fusion Middleware Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 contains a broken access control vulnerability caused by improper authorization checks, letting unauthenticated attackers with network access via TCP create, delete, or modify critical data, exploit requires network access with high attack complexity.

  • 7.8 /10 High
    CVE-2026-83024 Auth required

    Oracle Identity Manager Connector - Privilege Escalation

    Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 contains a privilege escalation vulnerability caused by insufficient access controls, letting low privileged attackers with logon to the infrastructure take over the component, exploit requires attacker logon.

  • 8.6 /10 High
    CVE-2026-83023 No auth

    Oracle Identity Manager Connector - Broken Access Control

    Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 contains an unauthorized access vulnerability caused by unauthenticated network access via HTTP, letting unauthenticated attackers access critical data, exploit requires network access.

  • 7.9 /10 High
    CVE-2026-83022 No auth

    Oracle WebCenter Enterprise Capture - Authentication Bypass

    Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 contains a takeover vulnerability caused by a flaw in the Client Bundle, letting unauthenticated attackers with physical network access and user interaction take over the system, exploit requires human interaction from a non-attacker.

  • 8.1 /10 High
    CVE-2026-83019 Auth required

    Oracle PeopleSoft PeopleTools - Broken Access Control

    Oracle PeopleSoft PeopleTools 8.61-8.63 contains an unauthorized access and denial of service vulnerability caused by improper access control in SQR component, letting low privileged network attackers access or crash the system via HTTP.

  • 7.8 /10 High
    CVE-2026-83018 Auth required

    Oracle PeopleSoft PeopleTools - Remote Code Execution

    Oracle PeopleSoft PeopleTools 8.61-8.63 contains a remote code execution caused by vulnerability in SQR component, letting low privileged attackers with logon take over the system, exploit requires attacker logon.

  • 8.8 /10 High
    CVE-2026-83017 Auth required

    Oracle PeopleSoft PeopleTools - Remote Code Execution

    Oracle PeopleSoft PeopleTools 8.61-8.63 contains a remote code execution caused by vulnerability in Report Distribution component, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privilege network access.