High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 453 of 556
- 7.1 /10 HighCVE-2026-12667 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an XML external entity injection caused by improper handling of XML external entities in RFH2 folder parsing, letting authenticated attackers read files or cause limited denial of service.
- 8.1 /10 HighCVE-2026-12666 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java contain an XML external entity injection caused by improper MQRFH2 header processing, letting authenticated attackers obtain sensitive information or cause denial of service, exploit requires authentication.
- 7.5 /10 HighCVE-2026-12358 No auth
IBM Verify Identity Access - Denial of Service
IBM Verify Identity Access contains a denial of service vulnerability caused by insufficient validation of incoming request resources, letting remote attackers cause service disruption, exploit requires crafted requests.
- 8.1 /10 HighCVE-2026-12355 No auth
IBM MQ - JNDI Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a JNDI injection caused by insufficient input validation, letting attackers perform remote code execution or information disclosure, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-12354 Auth required
IBM MQ - Remote Code Execution
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a remote code execution caused by improper validation of JNDI names in the Resource Adapter Installation Verification Test application, letting authenticated attackers execute arbitrary code on the application server, exploit requires authentication.
- 7.0 /10 HighCVE-2026-12150
IBM MQ - Denial of Service
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a denial of service caused by improper validation of deeply nested certificate data during TLS certificate processing, letting remote attackers with trusted TLS client certificates cause service disruption and potential memory corruption, exploit requires trusted TLS client certificate.
- 8.1 /10 HighCVE-2026-12101 No auth
IBM Verify Identity Access - Broken Access Control
IBM Verify Identity Access contains a broken access control vulnerability caused by improper validation of user-supplied requests, letting administrators execute unauthorized commands, exploit requires administrator privileges.
- 7.2 /10 HighCVE-2026-11934 Auth required
IBM Verify Identity Access - Command Injection
IBM Verify Identity Access contains a command injection caused by improper validation of user supplied input, letting administrators execute unauthorized commands, exploit requires administrator privileges.
- 7.5 /10 HighCVE-2026-11929
IBM Security Verify Identity Access Reverse Proxy - Weak Cryptography
IBM Security Verify Identity Access Reverse Proxy contains a weak cryptographic validation vulnerability caused by improper validation of user supplied data, letting attackers bypass cryptographic protections, exploit requires specific configuration.
- 7.5 /10 HighCVE-2026-11926 No auth
IBM Verify Identity Access - Denial of Service
IBM Verify Identity Access contains a denial of service vulnerability caused by insufficient validation of incoming request resources, letting remote attackers cause service disruption, exploit requires crafted requests.
- 8.5 /10 HighCVE-2026-11729 Auth required
IBM MQ - Insecure Deserialization
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an insecure deserialization vulnerability caused by unsafe deserialization enabling JNDI injection, letting authenticated attackers execute arbitrary code in client applications, exploit requires authentication.
- 8.1 /10 HighCVE-2026-11728 No auth
IBM MQ - Buffer Overflow
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a heap buffer overflow caused by improper handling of messages from malicious queue managers or man-in-the-middle attacks, letting remote attackers cause denial of service or execute arbitrary code in the client, exploit requires network access to the client.
- 7.8 /10 HighCVE-2026-10144 No auth
Rsbuild - Command Injection
Rsbuild < 2.0.9 contains a command injection caused by improper sanitization of shell metacharacters in URLs passed to server.open configuration on macOS, letting attackers execute arbitrary OS commands remotely, exploit requires crafted URL with shell metacharacters.
- 8.8 /10 HighCVE-2026-0200 Auth required
Cellular Modem - Privilege Escalation
Cellular Modem contains an out-of-bounds write caused by a heap buffer overflow, letting remote attackers escalate privileges without additional execution privileges, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-0199 Auth required
gf_ta_test - Buffer Overflow
gf_ta_test.c contains a buffer overflow caused by improper input validation in gf_ta_test_set_config, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.