High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 457 of 556
- 7.5 /10 HighCVE-2026-87779 No auth
Apache Syncope - Information Disclosure
Apache Syncope 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an information disclosure vulnerability caused by logging padded AES keys of non-standard length, letting attackers access sensitive information, exploit requires access to logs.
- 7.8 /10 HighCVE-2026-86917 Auth required
Apple macOS - Privilege Escalation
Apple macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 contain a privilege escalation caused by insufficient permission restrictions, letting apps gain root privileges, exploit requires app execution.
- 7.5 /10 HighCVE-2026-86904 No auth
Apple iOS & iPadOS - Privacy Violation
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and watchOS 27 contain a privacy issue caused by improper state management, letting apps track users across apps and websites without permission, exploit requires malicious app installation.
- 7.1 /10 HighCVE-2026-86901 Auth required
Apple macOS - Out of Bounds Write
Apple macOS Golden Gate 27 contains an out-of-bounds write caused by insufficient bounds checking when mounting a maliciously crafted exFAT volume, letting attackers cause system termination or kernel memory disclosure, exploit requires mounting the crafted volume.
- 7.5 /10 HighCVE-2026-86895 No auth
Apple - Information Disclosure
Apple iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 contain an information disclosure caused by improper state management, letting local apps read persistent account identifiers, exploit requires local app access.
- 7.5 /10 HighCVE-2026-86894 No auth
Apple macOS Golden Gate - Sandbox Escape
Apple macOS Golden Gate 27 contains a sandbox escape caused by a logic issue due to insufficient checks, letting applications break out of their sandbox, exploit requires app execution within sandbox.
- 7.2 /10 HighCVE-2026-86830 Auth required
AWS IAM Identity Center TEAM - Broken Access Control
AWS IAM Identity Center TEAM before 1.5.1 contains a broken access control caused by incorrect privilege assignment in Temporary Elevated Access Management, letting authenticated remote users read, approve, modify, or revoke arbitrary access requests, exploit requires application-level access.
- 8.2 /10 HighCVE-2026-85921 Auth required
Windows Secure Kernel Mode - Privilege Escalation
Windows Secure Kernel Mode contains a double free vulnerability that allows an authorized attacker to elevate privileges locally, exploit requires local authorized access.
- 7.8 /10 HighCVE-2026-85892 Auth required
Microsoft Edge - Privilege Escalation
Microsoft Edge (Chromium-based) contains a race condition caused by concurrent execution using shared resources with improper synchronization, letting authorized attackers elevate privileges locally, exploit requires local access.
- 7.3 /10 HighCVE-2026-84632
Apple - Memory Corruption
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a memory corruption vulnerability caused by processing a maliciously crafted 3D model, letting attackers cause memory corruption, exploit requires processing of malicious 3D model.
- 7.8 /10 HighCVE-2026-84631 Auth required
Apple macOS Golden Gate - Privilege Escalation
Apple macOS Golden Gate contains a privilege escalation caused by insufficient entitlement checks, letting a local app gain root privileges, exploit requires local app execution.
- 7.5 /10 HighCVE-2026-84629 No auth
Apple iOS - Information Disclosure
Apple iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 contain an information disclosure vulnerability caused by insufficient entitlement checks, letting apps fingerprint users, exploit requires app installation.
- 7.5 /10 HighCVE-2026-84623 No auth
Apple iOS & iPadOS - Broken Access Control
Apple iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27 contain an authorization issue caused by improper state management, letting apps fingerprint the device, exploit requires app installation.
- 7.3 /10 HighCVE-2026-84620 Auth required
Apple - Integer Overflow
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain an integer overflow caused by improper input validation in 3D model processing, letting attackers cause memory corruption, exploit requires processing a maliciously crafted 3D model.
- 7.3 /10 HighCVE-2026-84611 Auth required
Apple - Out of Bounds Write
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain an out-of-bounds write caused by improper bounds checking in 3D model processing, letting attackers cause memory corruption, exploit requires processing a maliciously crafted 3D model.