High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 517 of 552
- 7.8 /10 HighCVE-2026-83970 Auth required
Windows Biometric Service - Privilege Escalation
Windows Biometric Service contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-83969 Auth required
Windows Biometric Service - Privilege Escalation
Windows Biometric Service contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-83968 Auth required
Windows Biometric Service - Privilege Escalation
Windows Biometric Service contains a use after free vulnerability, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-83967 Auth required
Windows Biometric Service - Privilege Escalation
Windows Biometric Service contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-83955 Auth required
Windows Biometric Service - Privilege Escalation
Windows Biometric Service contains a heap-based buffer overflow, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-83954 Auth required
Windows Biometric Service - Privilege Escalation
Windows Biometric Service contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-83952 Auth required
Windows Resilient File System - Privilege Escalation
Windows Resilient File System (ReFS) contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers elevate privileges locally, exploit requires local access with authorization.
- 8.0 /10 HighCVE-2026-83948 Auth required
Microsoft Azure CLI - Command Injection
Microsoft Azure CLI contains a command injection caused by improper neutralization of special elements in commands, letting authorized attackers execute code over a network, exploit requires attacker authorization.
- 7.8 /10 HighCVE-2026-83942 Auth required
Windows Kernel - Broken Access Control
Windows Kernel contains a broken access control vulnerability caused by missing authorization, letting authorized attackers elevate privileges locally, exploit requires local access with authorization.
- 7.0 /10 HighCVE-2026-83940 Auth required
Windows Device Association Service - Privilege Escalation
Windows Device Association Service contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory corruption.
- 8.2 /10 HighCVE-2026-83939 Auth required
Windows Secure Kernel Mode - Privilege Escalation
Windows Secure Kernel Mode contains a privilege escalation caused by untrusted pointer dereference, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-83498 Auth required
Windows Virtualization-Based Security Enclave - Privilege Escalation
Windows Virtualization-Based Security (VBS) Enclave contains a privilege escalation caused by untrusted pointer dereference, letting authorized attackers elevate privileges locally, exploit requires local access with authorization.
- 8.8 /10 HighCVE-2026-82537 No auth
Roo-Code - Command Injection
Roo-Code through 3.54.0 contains a command injection caused by a word-boundary mismatch in comment handling between the approval gate's shell parser and bash, letting attackers execute denied shell commands with auto-execute privileges, exploit requires crafted command string with allowlisted word followed by hash and denied command.
- 8.8 /10 HighCVE-2026-82536 No auth
Roo-Code - Command Injection
Roo-Code <= 3.54.0 contains an auto-approve bypass caused by omission of the bash pipe operator in shell command parsing, letting attackers execute denied shell commands with agent privileges, exploit requires crafted command line.
- 7.8 /10 HighCVE-2026-82007 No auth
Adobe Photoshop Desktop - Integer Overflow
Adobe Photoshop Desktop contains an integer overflow caused by improper handling of file data, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.