High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 464 of 552

  • 7.1 /10 High
    CVE-2026-19816 Auth required

    PackageKit - Broken Access Control

    PackageKit with dnf5 backend contains a broken access control vulnerability caused by improper polkit authorization check skipping for SIMULATE flag in RepoRemove handler, letting unprivileged local users uninstall packages, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-19624 Auth required

    NetworkManager-l2tp - Command Injection

    NetworkManager-l2tp contains a command injection caused by unescaped attacker-controlled VPN connection properties in ipsec.conf, letting local unprivileged users escalate privileges to root via crafted L2TP VPN profiles.

  • 7.7 /10 High
    CVE-2026-19499

    GNU C Library - Buffer Overflow

    GNU C Library 2.38 to 2.44 contains a buffer overflow caused by strfmon and strfmon_l functions writing past the end of the output buffer with right-justified width padding, letting attackers cause memory corruption, exploit requires specific application code paths with vulnerable buffer sizes.

  • 7.5 /10 High
    CVE-2026-19290 No auth

    IBM Sterling File Gateway - Information Disclosure

    IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 contains an information disclosure vulnerability caused by improper access control, letting remote attackers obtain sensitive information, exploit requires no special privileges.

  • 8.2 /10 High
    CVE-2026-17467 No auth

    IBM Cloud Pak for Data System - Weak Cryptography

    IBM Cloud Pak for Data System Yosemite 1.0 3.0.5.2 contains weak cryptography caused by use of weak or deprecated cryptographic protocols, letting remote attackers obtain sensitive information, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-17416 No auth

    IBM App Connect Enterprise - Remote Code Execution

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 contain an insecure deserialization vulnerability caused by insecure deserialization, letting local attackers execute arbitrary code.

  • 7.8 /10 High
    CVE-2026-17156 No auth

    IBM App Connect Enterprise - Remote Code Execution

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 contain an insecure deserialization vulnerability caused by insecure deserialization, letting local attackers execute arbitrary code.

  • 7.8 /10 High
    CVE-2026-17133 No auth

    IBM App Connect Enterprise - Command Injection

    IBM App Connect Enterprise 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0 contain a command injection caused by improper neutralization of special elements in OS commands, letting local attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-16673 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special characters in the PxPeek name property, letting remote authenticated attackers execute arbitrary OS commands.

  • 8.8 /10 High
    CVE-2026-16466 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper handling of OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 7.7 /10 High
    CVE-2026-16432 Auth required

    IBM DataStage - XML External Entity Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an XML external entity injection caused by improper handling in PxXMLInput operator, letting remote authenticated attackers obtain sensitive information.

  • 8.8 /10 High
    CVE-2026-16428 Auth required

    IBM DataStage - Remote Code Execution

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a remote code execution caused by improper configuration of the XSLT transformation engine, letting remote authenticated attackers execute arbitrary code.

  • 8.1 /10 High
    CVE-2026-16335 Auth required

    IBM DataStage - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers read, write, or delete arbitrary files, exploit requires authentication.

  • 7.5 /10 High
    CVE-2026-15955 No auth

    IBM Db2 - Unrestricted File Upload

    IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain an unrestricted file write vulnerability caused by improper validation of file paths, letting remote attackers write arbitrary files, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-13293 Auth required

    IBM MQ - Insecure Deserialization

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote authenticated attackers execute arbitrary code on the system, exploit requires authentication.