High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 447 of 556
- 8.5 /10 HighCVE-2026-59973 Auth required
FrontMCP - Server Side Request Forgery
FrontMCP mcp-from-openapi 2.3.0 to 2.5.0 and frontmcp & @frontmcp/adapters 1.2.1 to 1.5.0 contain a server-side request forgery caused by improper validation of external $ref URLs in OpenAPI specs, letting authenticated users access internal network services, exploit requires authenticated user able to import or configure OpenAPI specs.
- 7.1 /10 HighCVE-2026-59965 Auth required
Payload Plugins - Broken Access Control
Payload Plugins 0.7.0 contains a broken access control vulnerability caused by missing overrideAccess checks in alt-text plugin endpoints, letting authenticated low-privilege users read and modify protected upload documents, exploit requires authentication.
- 8.8 /10 HighCVE-2026-59160 No auth
Yeger turbo-graph - Command Injection
Yeger turbo-graph < 2.8.9 contains a command injection caused by unauthenticated /api/run handler passing attacker-controlled task names to spawn(), letting adjacent-network attackers execute arbitrary tasks with developer OS user privileges, exploit requires network access to the server.
- 7.8 /10 HighCVE-2026-58766 Auth required
arm-smmu-v3 - Privilege Escalation
arm-smmu-v3.c contains a privilege escalation caused by a logic error in multiple functions, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-58744 Auth required
Unknown - Privilege Escalation
Unknown product contains a privilege escalation caused by improper input validation in multiple locations, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.0 /10 HighCVE-2026-58734 Auth required
Google mba_poll - Privilege Escalation
Google mba_poll contains an out-of-bounds write caused by a race condition in google_mba_recv_msg, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.0 /10 HighCVE-2026-58728 Auth required
ARM64_TLBI - Race Condition
ARM64_TLBI in mmu.h contains a race condition causing memory corruption, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.0 /10 HighCVE-2026-58724 Auth required
Multiple Products - Use After Free
Multiple products contain a use-after-free vulnerability caused by a race condition, letting local attackers escalate privileges, exploit requires system execution privileges.
- 8.8 /10 HighCVE-2026-58710 Auth required
AOMedia AV1 - Remote Code Execution
AOMedia AV1 codec contains a buffer overflow caused by missing bounds check in DecodeFilmGrainParams in film_grain_dec.cc, letting remote attackers execute arbitrary code, exploit requires no special privileges or user interaction.
- 8.8 /10 HighCVE-2026-58704 CISA KEVNo auth
Cellular Modem - Broken Access Control
Cellular Modem contains a permission bypass caused by a logic error in the code, letting remote adjacent attackers escalate privileges without additional execution privileges, exploit requires no user interaction.
- 7.0 /10 HighCVE-2026-58701 Auth required
Generic ARM64 smcall - Privilege Escalation
Generic ARM64 smcall in trusty_dputc contains a race condition causing out-of-bounds write, letting local attackers escalate privileges, exploit requires system execution privileges.
- 8.4 /10 HighCVE-2026-58699 No auth
Vp9DecEndOfStream - Out of Bounds Read
Vp9DecEndOfStream in vp9hwd_output.cc contains an out-of-bounds read caused by incorrect bounds check, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-58695 Auth required
GMC PHY - Privilege Escalation
GMC PHY contains a privilege escalation caused by missing bounds check in gmc_phy_lp3_exit_restore_registers function, letting local attackers escalate privileges, exploit requires system execution privileges.
- 8.4 /10 HighCVE-2026-58691 No auth
FsmReleaseKey - Broken Access Control
FsmReleaseKey in fsm.c contains a permission bypass caused by improper input validation, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 8.8 /10 HighCVE-2026-58683 Auth required
IP Multimedia Subsystem - Remote Code Execution
IP Multimedia Subsystem contains an out-of-bounds write caused by improper input validation, letting remote attackers execute arbitrary code without additional privileges, exploit requires no user interaction.