High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 463 of 552
- 8.8 /10 HighCVE-2026-43692 No auth
Apple macOS - Remote Code Execution
Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a remote code execution caused by insufficient input sanitization, letting remote attackers cause app termination or execute arbitrary code, exploit requires crafted input.
- 7.8 /10 HighCVE-2026-43691 Auth required
Apple macOS - Privilege Escalation
Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a privilege escalation caused by a path handling issue due to insufficient validation, letting local apps gain root privileges, exploit requires local app execution.
- 7.8 /10 HighCVE-2026-43689 Auth required
Apple iOS & macOS - Privilege Escalation
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 contain a privilege escalation caused by insufficient permissions restrictions, letting malicious apps gain root privileges, exploit requires malicious app execution.
- 7.8 /10 HighCVE-2026-43688 No auth
Apple iOS & iPadOS & macOS Golden Gate - Denial of Service
Apple iOS 27, iPadOS 27, and macOS Golden Gate 27 contain a memory corruption caused by insufficient input validation when processing maliciously crafted files, letting attackers cause denial of service, exploit requires crafted malicious file.
- 8.8 /10 HighCVE-2026-43686 No auth
Apple iOS & macOS - Use After Free
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a use-after-free vulnerability caused by improper memory management when connecting to a malicious NFS server, letting attackers cause kernel memory corruption, exploit requires connection to a malicious NFS server.
- 7.8 /10 HighCVE-2026-43684 Auth required
Apple iOS & macOS - Use After Free
Apple iOS 26.7, iPadOS 26.7, macOS Golden Gate 27, and macOS Sequoia 15.8 contain a use-after-free vulnerability caused by improper memory management, letting apps cause system termination or kernel memory corruption, exploit requires malicious app.
- 7.1 /10 HighCVE-2026-43683 Auth required
Apple macOS - Out of Bounds Read
Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain an out-of-bounds read caused by insufficient bounds checking, letting apps cause process termination or disclose process memory, exploit requires app execution.
- 7.5 /10 HighCVE-2026-33963 Auth required
Samsung Mobile Processor Exynos - Denial of Service
Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 contain a stack-based buffer overflow caused by malformed messages sent to the camera driver, letting attackers cause denial of service remotely, exploit requires sending malformed message.
- 7.7 /10 HighCVE-2026-31278 PoC publicAuth required
Suprema BioStar - Information Disclosure
Suprema BioStar 2 < 2.9.12 and BioStar X < 1.0.2 contain an information disclosure vulnerability caused by improper protection of Active Directory service account credentials in /api/v2/setting/adserversetting endpoint, letting attackers obtain credentials in cleartext via crafted GET request, exploit requires network access.
- 7.5 /10 HighCVE-2026-28960 No auth
Apple iOS & iPadOS - Denial of Service
Apple iOS and iPadOS < 18.7.10 contain a denial-of-service caused by insufficient validation, letting remote attackers cause service disruption, exploit requires crafted requests.
- 7.5 /10 HighCVE-2026-28938 No auth
Apple iOS & iPadOS - Information Disclosure
Apple iOS and iPadOS 26.6 contain an information disclosure vulnerability caused by improper handling of sensitive data, letting apps fingerprint users, exploit requires app installation.
- 7.5 /10 HighCVE-2026-28935 No auth
Apple - Out of Bounds Read/Write
Apple iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27 contain a memory corruption vulnerability caused by improper memory handling, letting apps cause system termination or kernel memory corruption, exploit requires malicious app execution.
- 8.1 /10 HighCVE-2026-25687 No auth
Zscaler Client Connector - Race Condition
Zscaler Client Connector contains a race condition in the ZPA tunnel handler causing heap corruption, letting attackers cause denial of service or execute arbitrary code, exploit requires no special conditions.
- 7.8 /10 HighCVE-2026-23789
Samsung Exynos - Use After Free
Samsung Mobile Processor and Wearable Processor Exynos series contain a double-free vulnerability caused by improper cleanup of dma_buf references in the Exynos MFC encoder driver, letting attackers cause kernel memory corruption and potentially execute arbitrary code, exploit requires kernel-level access.
- 7.1 /10 HighCVE-2026-20683 No auth
Apple - Authentication Bypass
Apple iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27 contain an authentication bypass caused by improper state management in the Sign In With Apple flow, letting apps access user Apple Accounts, exploit requires app to use the Sign In With Apple authentication flow.