High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 5 of 725

  • 8.4 /10 High
    CVE-2026-58826 No auth

    ksys_unshare - Use After Free

    The ksys_unshare function in fork.c contains a use after free vulnerability, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58825 No auth

    fork.c - Use After Free

    The fork.c component contains a use after free vulnerability caused by a logic error, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-55289 No auth

    Affected product - Privilege Escalation

    Affected product contains a local privilege escalation caused by confused deputy leading to execution of sensitive USSD codes, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-55287 No auth

    GrantCredentialsPermissionActivity - Privilege Escalation

    GrantCredentialsPermissionActivity contains a privilege escalation caused by misleading or insufficient UI in GrantCredentialsPermissionActivity.java onCreate, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-55283 No auth

    Affected Product - Use After Free

    Affected product contains a use-after-free vulnerability caused by improper memory management, letting remote attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-55275 No auth

    Multiple Products - Privilege Escalation

    Multiple products contain a use-after-free vulnerability caused by a race condition, letting remote attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-55271 No auth

    ContactsPickerActivity - Broken Access Control

    ContactsPickerActivity in ContactsPickerActivity.kt contains an intent redirection caused by a confused deputy issue, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-55262 No auth

    NotificationManagerService - Broken Access Control

    NotificationManagerService contains a broken access control caused by improper input validation in setNotificationListenerAccessGrantedForUserInternal, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-55257 No auth

    UsbDialogHelper - UI Confusion

    UsbDialogHelper contains a UI confusion caused by misleading or insufficient UI in UsbDialogHelper.java, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-49931 No auth

    Android - Broken Access Control

    Android contains a local escalation of privilege caused by a confused deputy in onActivityResult leading to contact leak from protected profile, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-49923 No auth

    AccountManagerService - Misleading UI

    AccountManagerService contains a misleading UI vulnerability caused by a logic error in onResult method, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-49922 No auth

    ConnectionServiceWrapper - Broken Access Control

    ConnectionServiceWrapper.java contains a permission bypass caused by a confused deputy in queryRemoteConnectionServices, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-45514 No auth

    SaveUi - Broken Access Control

    SaveUi.java contains a broken access control caused by a logic error in package installation requirements, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-29508 Auth required

    ReadyMedia - Buffer Overflow

    ReadyMedia 1.3.0 through 1.3.3 contains a stack-based buffer overflow caused by unvalidated oversized PROP chunk size in DFF audio files, letting remote attackers achieve remote code execution or denial of service via crafted files in monitored directories.

  • 8.4 /10 High
    CVE-2026-28597 No auth

    Android UriGrantsManagerService - Broken Access Control

    Android UriGrantsManagerService contains a permission bypass caused by improper input validation in writeGrantedUriPermissions, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.