High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 47 of 552

  • 7.0 /10 High
    CVE-2026-96209 Auth required

    Windows Network File System - Privilege Escalation

    Windows Network File System contains an out-of-bounds read vulnerability allowing authorized attackers to elevate privileges locally, exploit requires local access with authorization.

  • 8.8 /10 High
    CVE-2026-96202 No auth

    Windows Raw Image Extension - Remote Code Execution

    Windows Raw Image Extension contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 7.3 /10 High
    CVE-2026-96188 Auth required

    Microsoft PowerToys - Privilege Escalation

    Microsoft PowerToys contains a privilege escalation caused by external control of system or configuration settings, letting authorized attackers elevate privileges locally, exploit requires local access with authorization.

  • 7.8 /10 High
    CVE-2026-96186 Auth required

    Microsoft Windows Media Foundation - Authentication Bypass

    Microsoft Windows Media Foundation contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting authorized attackers elevate privileges locally, exploit requires attacker authorization.

  • 7.8 /10 High
    CVE-2026-96118 Auth required

    Windows Graphics Kernel - Privilege Escalation

    Windows Graphics Kernel contains an out-of-bounds read caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.

  • 7.8 /10 High
    CVE-2026-96108 Auth required

    Desktop Window Manager - Privilege Escalation

    Desktop Window Manager contains a use after free vulnerability that allows an authorized local attacker to elevate privileges by exploiting memory management flaws.

  • 7.5 /10 High
    CVE-2026-96071 No auth

    Windows Media - Remote Code Execution

    Windows Media contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-96044 Auth required

    Microsoft Office SharePoint - Privilege Escalation

    Microsoft Office SharePoint contains a privilege escalation vulnerability allowing authorized attackers to elevate privileges over a network, exploit requires attacker to be authorized.

  • 7.0 /10 High
    CVE-2026-95943 Auth required

    Connected Devices Platform Service - Privilege Escalation

    Connected Devices Platform Service (Cdpsvc) contains a double free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory management flaws.

  • 7.4 /10 High
    CVE-2026-95695 No auth

    IBM WebSphere Application Server Liberty - Broken Access Control

    IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 contains a broken access control caused by incorrect authorization, letting remote attackers bypass security restrictions, exploit requires network access.

  • 8.0 /10 High
    CVE-2026-95680 Auth required

    IBM WebSphere Application Server - Authorization Bypass

    IBM WebSphere Application Server 8.5 and 9.0 contain an authorization bypass caused by improper access control, letting authenticated attackers impersonate administrators across the cell, exploit requires authentication.

  • 7.8 /10 High
    CVE-2026-95641 No auth

    Adobe Photoshop Desktop - Remote Code Execution

    Adobe Photoshop Desktop contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 8.6 /10 High
    CVE-2026-95639 No auth

    Photoshop Desktop - Broken Access Control

    Photoshop Desktop contains an incorrect authorization vulnerability caused by improper access control, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-95638 No auth

    Photoshop Desktop - Remote Code Execution

    Photoshop Desktop contains a heap-based buffer overflow caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-95637 No auth

    Adobe Photoshop Desktop - Remote Code Execution

    Adobe Photoshop Desktop contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.