High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 449 of 556

  • 8.8 /10 High
    CVE-2026-56997 Auth required

    VP9 - Out of Bounds Write

    VP9 hardware decoder contains an out-of-bounds write caused by missing bounds check in Av1DecodeFrameTag, letting remote attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-56986 No auth

    Multiple files - Privilege Escalation

    Multiple files contain an out-of-bounds read caused by type confusion, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-56985 No auth

    Multiple files - Privilege Escalation

    Multiple files contain a local privilege escalation caused by type confusion, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-56982 Auth required

    VPU - Permission Bypass

    VPU contains a permission bypass caused by missing permission check, letting local attackers escalate privileges, exploit requires system execution privileges.

  • 8.4 /10 High
    CVE-2026-56978 No auth

    Generic - Out of Bounds Read

    A vulnerability in get_global_config_item_addr of gc.c contains an out-of-bounds read caused by missing bounds check, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-56974 Auth required

    AudioRtpPayloadEncoderNode - Remote Code Execution

    Start of AudioRtpPayloadEncoderNode.cpp contains an out-of-bounds write caused by improper input validation, letting remote attackers execute arbitrary code, exploit requires user interaction.

  • 8.4 /10 High
    CVE-2026-56970 No auth

    Multiple Products - Broken Access Control

    Multiple locations contain a permission bypass caused by missing permission checks, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.0 /10 High
    CVE-2026-56967 Auth required

    Cellular Modem - Remote Code Execution

    Cellular Modem contains an out-of-bounds write caused by a heap buffer overflow, letting remote proximal attackers execute code without additional privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-56945 Auth required

    VPU - Privilege Escalation

    VPU contains an out-of-bounds write caused by a confused deputy issue, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-56942 Auth required

    vp9hwd_headers.cc - Out of Bounds Write

    vp9hwd_headers.cc contains an out-of-bounds write caused by a missing bounds check in ReadTileInfo, letting remote attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-56941 No auth

    fpc_tee_hal - Use After Free

    fpc_tee_hal.c contains a use-after-free caused by a logic error in multiple functions, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-56920 Auth required

    Unknown - Out of Bounds Read/Write

    A vulnerability in s_decode_vui_param function of fw_hevc_dec_header.c causes an out-of-bounds write due to a logic error, letting remote attackers execute code without additional privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-56914 No auth

    Generic Software - Privilege Escalation

    Affected software contains a use-after-free vulnerability caused by improper locking in multiple locations, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-56882 Auth required

    Cellular Modem - Remote Code Execution & Information Disclosure

    Cellular Modem contains an information disclosure caused by a logic error in the code, letting remote attackers execute code without additional privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-56881 No auth

    Unknown - Broken Access Control

    Unknown vendor product contains a broken access control vulnerability caused by a logic error in enable_segment of remap.c, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.