High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 48 of 552

  • 7.8 /10 High
    CVE-2026-95636 No auth

    Adobe Photoshop Desktop - Integer Overflow

    Adobe Photoshop Desktop contains an integer overflow caused by improper handling of file data, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-95635 No auth

    Adobe Photoshop Desktop - Remote Code Execution

    Adobe Photoshop Desktop contains a double free vulnerability caused by improper memory management, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 8.6 /10 High
    CVE-2026-95634 No auth

    CAI Content Credentials - Privilege Escalation

    CAI Content Credentials contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.

  • 7.5 /10 High
    CVE-2026-95633 No auth

    CAI Content Credentials - Authentication Bypass

    CAI Content Credentials contains an improper verification of cryptographic signature vulnerability, letting attackers bypass security features and gain unauthorized write access, exploit requires no user interaction.

  • 7.5 /10 High
    CVE-2026-95632 No auth

    CAI Content Credentials - Authentication Bypass

    CAI Content Credentials contains an improper verification of cryptographic signature vulnerability, letting attackers bypass security features and gain unauthorized write access, exploit requires no user interaction.

  • 8.7 /10 High
    CVE-2026-95631 Auth required

    Adobe Commerce - Remote Code Execution

    Adobe Commerce contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires high privileges.

  • 7.5 /10 High
    CVE-2026-95124 No auth

    madmurphy libconfini - Buffer Overflow

    madmurphy libconfini 1.16.4 contains a buffer overflow caused by an allocation-size mismatch between load_ini_buffer utility and strip_ini_cache(), letting remote attackers cause denial of service, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-95122 No auth

    mp4v2 - Denial of Service

    mp4v2 2.0.0 contains a null pointer dereference vulnerability caused by improper handling in MP4File::GenerateTracks() in src/mp4file.cpp, letting remote attackers cause denial of service, exploit requires crafted input.

  • 7.8 /10 High
    CVE-2026-95121 Auth required

    mp4v2 - Remote Code Execution

    mp4v2 2.0.0 contains a buffer overflow caused by unchecked offset subtraction in MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp, letting attackers execute arbitrary code via a crafted MP4 file, exploit requires crafted file input.

  • 7.5 /10 High
    CVE-2026-95115 No auth

    libwebsockets - Buffer Overflow

    libwebsockets main 106d542c contains a buffer overflow caused by improper handling in the LEJP JSON parser, letting remote attackers cause denial of service, exploit requires crafted JSON input.

  • 7.5 /10 High
    CVE-2026-95114 No auth

    libwebsockets - Denial of Service

    libwebsockets contains an out-of-bounds read vulnerability caused by improper bounds checking in the LEJP incremental parser in lib/misc/lejp.c, letting remote attackers cause denial of service, exploit requires crafted network requests.

  • 8.8 /10 High
    CVE-2026-94512 Auth required

    Microsoft SQL Server - Buffer Overflow

    Microsoft SQL Server contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers execute code remotely over a network, exploit requires valid credentials.

  • 7.5 /10 High
    CVE-2026-94453 No auth

    Libreswan - Use After Free

    Libreswan pluto daemon contains a use-after-free vulnerability caused by retaining invalid pointers after IKE over TCP client disconnects, letting remote attackers cause denial of service or possibly remote code execution, exploit requires IKE over TCP enabled with listen-tcp=yes.

  • 8.1 /10 High
    CVE-2026-93907 No auth

    IBM WebSphere Application Server - Authentication Bypass

    IBM WebSphere Application Server 8.5 and 9.0 contain an authentication bypass caused by a flaw in the CSIv2 inbound propagation handler, letting remote attackers bypass authentication, exploit requires network access.

  • 8.2 /10 High
    CVE-2026-93905 No auth

    IBM WebSphere Application Server Liberty - Broken Access Control

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 contains a data tampering vulnerability caused by improper handling of batch job instance status persistence, letting unauthenticated remote attackers corrupt batch job statuses, exploit requires network access.