High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 444 of 556
- 7.5 /10 HighCVE-2026-76687 Auth required
HPE Networking EdgeConnect SD-WAN Orchestrator - Command Injection & Privilege Escalation
HPE Networking EdgeConnect SD-WAN Orchestrator contains a command injection caused by insufficient input validation in the API endpoint, letting low-privilege authenticated remote attackers execute arbitrary system commands with root privileges.
- 7.5 /10 HighCVE-2026-76686 No auth
HPE Networking EdgeConnect SD-WAN Gateways - Denial of Service
HPE Networking EdgeConnect SD-WAN Gateways contain a denial-of-service vulnerability in the underlying operating system, letting unauthenticated remote attackers disrupt service availability, exploit requires no special privileges.
- 8.1 /10 HighCVE-2026-76685 No auth
Affected component - Integer Overflow
Affected component contains an integer overflow caused by improper processing of malformed or truncated input in proxy packet processing logic, letting unauthenticated remote attackers cause buffer overflow leading to remote code execution or denial of service, exploit requires crafted input.
- 8.1 /10 HighCVE-2026-76684 No auth
HPE Networking EdgeConnect SD-WAN Orchestrator - Authentication Bypass
HPE Networking EdgeConnect SD-WAN Orchestrator contains an authentication bypass caused by flaws in the API, letting unauthenticated remote attackers gain administrative privileges, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-76683
HPE Networking EdgeConnect SD-WAN Gateways - Buffer Overflow
HPE Networking EdgeConnect SD-WAN Gateways contain a buffer overflow caused by improper input handling in the API endpoint, letting unauthenticated remote attackers execute arbitrary commands, exploit requires specific preconditions outside attacker control.
- 8.2 /10 HighCVE-2026-76682 No auth
Intrusion Detection Systems - Buffer Overflow
Intrusion detection systems contain a buffer overflow in the network security monitoring component, letting unauthenticated remote attackers cause denial-of-service or execute arbitrary code, exploit requires network access.
- 8.5 /10 HighCVE-2026-76681 Auth required
EdgeConnect SD-WAN Orchestrator - Broken Access Control
EdgeConnect SD-WAN Orchestrator API contains a broken access control vulnerability caused by improper privilege checks, letting authenticated low-privilege attackers access sensitive information beyond their authorization, exploit requires authentication.
- 8.5 /10 HighCVE-2026-76680 Auth required
EdgeConnect SD-WAN Orchestrator - Server-Side Request Forgery
EdgeConnect SD-WAN Orchestrator API contains a server-side request forgery caused by improper input validation, letting remote attackers with low privileges enumerate internal host structure and disclose sensitive information, exploit requires low privilege authentication.
- 8.6 /10 HighCVE-2026-76679
HPE Networking EdgeConnect SD-WAN Gateways - Denial of Service
HPE Networking EdgeConnect SD-WAN Gateways contain a denial-of-service vulnerability caused by unspecified issues, letting unauthenticated adjacent attackers crash the system, exploit requires network adjacency.
- 8.8 /10 HighCVE-2026-76678 Auth required
HPE Networking EdgeConnect SD-WAN Gateways - Command Injection & Privilege Escalation
HPE Networking EdgeConnect SD-WAN Gateways contain a command injection caused by insufficient input validation in the API endpoint, letting low-privilege authenticated remote attackers execute arbitrary system commands with root privileges.
- 8.8 /10 HighCVE-2026-76677 Auth required
EdgeConnect SD-WAN Gateways - Privilege Escalation
EdgeConnect SD-WAN Gateways contain a privilege escalation vulnerability in the API, letting remote low-privileged authenticated users gain administrative privileges on the web-management interface, exploit requires user authentication.
- 8.8 /10 HighCVE-2026-76676
EdgeConnect SD-WAN Gateways - Buffer Overflow
EdgeConnect SD-WAN Gateways contain a buffer overflow caused by unspecified conditions in the underlying operating system, letting unauthenticated adjacent attackers execute arbitrary code as privileged users, exploit requires certain preconditions outside attacker control.
- 7.5 /10 HighCVE-2026-75983 Auth required
Eventin - Privilege Escalation
Eventin WordPress plugin <= 4.1.23 contains a privilege escalation caused by improper capability checks in PermissionManager::manage_permissions(), letting authenticated attackers with user ID 1 gain administrator privileges, exploit requires user ID 1 to have a lower-privilege role.
- 7.3 /10 HighCVE-2026-75092 Auth required
leapp-upgrade-el9toel10 - Privilege Escalation
leapp-upgrade-el9toel10 contains a privilege escalation caused by mysqld running as root bypassing systemd user context, letting attackers with mysql OS identity execute code as root during upgrade, exploit requires mysql OS-level execution and admin running Leapp upgrade.
- 7.2 /10 HighCVE-2026-73966 Auth required
Oracle Siebel CRM Siebel Apps - Marketing - Authentication Bypass
Oracle Siebel CRM Siebel Apps - Marketing 17.0-26.7 contains a vulnerability allowing high privileged attackers with network access via HTTP to take over the application, exploit requires high privileges.