High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 483 of 552
- 7.8 /10 HighCVE-2026-8303 Auth required
TUBITAK BILGEM Pardus-software - Privilege Escalation
TUBITAK BILGEM Pardus-software < 1.0.5 contains a privilege escalation caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.
- 7.8 /10 HighCVE-2026-8301 Auth required
TUBITAK BILGEM Pardus Boot Repair - OS Command Injection
TUBITAK BILGEM Pardus Boot Repair < 1.0.8 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.
- 8.3 /10 HighCVE-2026-82583 Auth required
NextGen Connect (Mirth Connect) - SQL Injection
NextGen Connect (Mirth Connect) <= 4.7.1 contains a SQL injection caused by improper sanitization in Database Connector API, letting authenticated users execute arbitrary SQL, leading to credential disclosure, file write, and DoS.
- 7.5 /10 HighCVE-2026-82578
XML Batch Processing - XML External Entity Injection
An XML batch processing component with XPath option enabled contains an XML External Entity (XXE) injection caused by lack of entity restrictions in default XPath/JAXP setup, letting attackers exfiltrate data and cause denial of service, exploit requires XML batch processing with XPath enabled.
- 7.1 /10 HighCVE-2026-81907 No auth
Concrete CMS - Cross-Site Request Forgery
Concrete CMS <= 9.5.2 contains a cross-site request forgery caused by lack of enforcement of CSRF token validation in the Express "Clear Entries" function, letting remote attackers force authenticated administrators to delete entries, exploit requires victim admin to visit attacker-controlled page.
- 7.2 /10 HighCVE-2026-81825 No auth
Simple Ajax Chat - Stored Cross-Site Scripting
Simple Ajax Chat WordPress plugin <= 20260811 contains a stored XSS caused by insufficient input sanitization and output escaping in chat messages, letting unauthenticated attackers inject persistent scripts executed by all users, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-81754 No auth
The Vigilant WordPress - Stored XSS
The Vigilant WordPress plugin <= 2.10.2 contains a stored cross-site scripting caused by insufficient sanitization and escaping of the User-Agent header, letting unauthenticated attackers inject scripts executed on user page access, exploit requires triggering a failed login with crafted User-Agent.
- 8.4 /10 HighCVE-2026-81017
Linux kernel - Out of Bounds Read & Write
Linux kernel platform/chrome sensorhub contains a buffer over-read and write caused by lack of validation of EC-reported sensor number in sensorhub batch_state indexing, letting attackers cause out-of-bounds memory access, exploit requires crafted EC FIFO events.
- 7.7 /10 HighCVE-2026-81016
Linux kernel - Broken Authentication
Linux kernel contains a broken authentication vulnerability caused by improper handling and validation of SMU command return values in platform/x86/amd/pmc, letting attackers cause system instability or denial of service, exploit requires access to trigger SMU commands.
- 7.8 /10 HighCVE-2026-81015
Linux Kernel - Denial of Service
Linux kernel contains a resource leak vulnerability caused by improper cleanup in amd_pmc_probe() when amd_stb_s2d_init() fails, letting attackers cause kernel crashes or unstable system state, exploit requires module reload or s2idle transition.
- 8.4 /10 HighCVE-2026-81012 No auth
Linux kernel - Buffer Overflow
Linux kernel contains an off-by-one write vulnerability in hp_get_string_from_buffer() due to improper boundary check on string length, letting local attackers cause memory corruption, exploit requires local access.
- 7.1 /10 HighCVE-2026-81011 Auth required
Linux kernel - Out-of-Bounds Read
Linux kernel platform/x86 hp-bioscfg contains an out-of-bounds read caused by forwarding incorrect element count to package parsers, letting attackers potentially cause heap read beyond array bounds, exploit requires crafted ACPI package data.
- 7.8 /10 HighCVE-2026-81010 Auth required
Linux Kernel io_uring - Denial of Service
Linux kernel io_uring contains a task_work cancellation handling flaw in io_waitid_cb(), causing incorrect child process wait behavior when fallback task_work runs from kworker, letting attackers cause denial of service by request cancellation.
- 7.8 /10 HighCVE-2026-81008
Linux Kernel - Use After Free
Linux kernel contains a use after free vulnerability in interconnect component caused by improper freeing of path object in icc_get() and of_icc_get_by_index(), letting local attackers cause memory corruption, exploit requires kernel debugfs access.
- 7.1 /10 HighCVE-2026-81007 Auth required
Linux Kernel - Buffer Validation Vulnerability
Linux kernel contains a buffer validation vulnerability in ipmb_write() caused by reading message fields before validating length, letting attackers cause memory corruption or information disclosure, exploit requires crafted IPMB messages.