High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 480 of 552
- 7.5 /10 HighCVE-2026-89477 No auth
Linux Kernel - Denial of Service
Linux kernel contains a NULL pointer dereference vulnerability in SCTP stream reconfiguration caused by completing untransmitted RECONF requests, letting unprivileged local attackers cause kernel panic, exploit requires local unprivileged process to remove last address and request stream reset.
- 7.5 /10 HighCVE-2026-89476 No auth
Linux Kernel - Integer Overflow
Linux kernel contains an integer underflow caused by duplicate SCTP RECONF responses processing the same ADD_OUT request multiple times, letting attackers potentially cause memory corruption, exploit requires sending duplicate RECONF responses.
- 7.8 /10 HighCVE-2026-89472 Auth required
Linux Kernel - Use After Free
Linux kernel power supply charger-manager contains a use-after-free vulnerability caused by improper ordering of regulator release and sysfs teardown, letting local users cause memory corruption via concurrent sysfs writes, exploit requires concurrent access to externally_control sysfs attribute.
- 8.4 /10 HighCVE-2026-89471
Linux Kernel - Out of Bounds Write
Linux kernel power supply cros_usbpd-charger contains a buffer overflow caused by improper validation of EC-reported port counts in cros_usbpd_charger_probe(), letting a malicious or compromised EC cause out-of-bounds write, exploit requires malicious or compromised EC.
- 8.4 /10 HighCVE-2026-89470
Linux kernel cros_usbpd - Out of Bounds Read/Write
Linux kernel power supply cros_usbpd driver contains an out-of-bounds write vulnerability caused by improper validation of port counts from the embedded controller, letting a malicious embedded controller cause memory corruption, exploit requires a malicious embedded controller.
- 8.4 /10 HighCVE-2026-89469 No auth
Linux kernel power supply lp8727 - Use After Free
Linux kernel power supply lp8727 contains a use-after-free vulnerability caused by improper IRQ release order in lp8727_release_irq(), letting attackers cause memory corruption or system crash, exploit requires IRQ handling race condition.
- 7.7 /10 HighCVE-2026-89466 No auth
Linux kernel power supply qcom_battmgr - Information Disclosure
Linux kernel power supply qcom_battmgr contains a buffer over-read caused by missing string termination in qcom_battmgr_sc8280xp_strcpy(), letting attackers cause information disclosure via user space reads, exploit requires crafted firmware string.
- 8.4 /10 HighCVE-2026-89465
Linux Kernel rt9455 - Use After Free
Linux kernel power supply rt9455 contains a use-after-free vulnerability caused by improper cancellation order of delayed work in rt9455_remove(), letting attackers trigger workqueue callbacks accessing freed memory, exploit requires kernel-level access.
- 7.0 /10 HighCVE-2026-89459 Auth required
Linux kernel - Denial of Service
Linux kernel s390/percpu contains an assembler macro argument parsing issue caused by improper whitespace handling in MVIY_PERCPU() macro, letting the assembler fail to emit necessary instructions, potentially causing exception return path failures, exploit requires use of older binutils versions.
- 7.0 /10 HighCVE-2026-89456
Linux Kernel s390/dasd - Data Tampering
Linux kernel s390/dasd contains a data tampering vulnerability caused by loss of partial completion length during ERP recovery in dasd_default_erp_postaction, letting attackers receive zeroed data instead of actual data, exploit requires specific ERP recovery conditions.
- 8.4 /10 HighCVE-2026-89452
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by improper cleanup of IOMMU device registration failures in msm_iommu_probe(), letting attackers cause system instability or denial of service, exploit requires triggering device registration failure.
- 8.8 /10 HighCVE-2026-89450 Auth required
Linux Kernel - Broken Access Control
Linux kernel contains a broken access control vulnerability caused by improper validation of vSID width in iommu/tegra241-cmdqv, letting a VMM cause Stream ID aliasing, exploit requires guest-controlled vdev->virt_id.
- 8.8 /10 HighCVE-2026-89445 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in iommufd selftest IOPF reporting caused by unsynchronized access to attach handles during PASID detach, letting attackers cause memory corruption, exploit requires concurrent device fault reporting.
- 7.1 /10 HighCVE-2026-89443 Auth required
Linux Kernel - Out-of-Bounds Read
Linux kernel contains an out-of-bounds read vulnerability caused by lack of validation of user-provided level in perf mask ioctls in platform/x86 ISST component, letting attackers cause memory disclosure, exploit requires crafted ioctl input.
- 7.8 /10 HighCVE-2026-89442 Auth required
Linux Kernel - Out of Bounds Read/Write
Linux kernel contains a buffer overflow caused by improper validation of socket_id in ISST clos_assoc ioctl, letting local attackers cause out-of-bounds access and NULL pointer dereference, exploit requires local access.