High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 602 of 628

  • 7.5 /10 High
    CVE-2026-77498 No auth

    Windows DHCP Server - Denial of Service

    Windows DHCP Server contains an out-of-bounds read vulnerability allowing unauthorized attackers to cause denial of service over a network, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-77495 No auth

    Microsoft Windows Imaging Component - Remote Code Execution

    Microsoft Windows Imaging Component contains a heap-based buffer overflow, letting unauthorized attackers execute code remotely over a network, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-77494 No auth

    Windows DHCP Server - Denial of Service

    Windows DHCP Server contains a type confusion vulnerability caused by access of resource using incompatible type, letting unauthorized attackers cause denial of service over a network, exploit requires no special privileges.

  • 7.8 /10 High
    CVE-2026-77489 Auth required

    Windows Biometric Service - Privilege Escalation

    Windows Biometric Service contains a null pointer dereference caused by improper handling of pointers, letting authorized local attackers elevate privileges, exploit requires local access with authorization.

  • 8.8 /10 High
    CVE-2026-77487 Auth required

    SQL Server - Broken Access Control

    SQL Server contains a broken access control vulnerability caused by improper access control, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 8.8 /10 High
    CVE-2026-77486 No auth

    Microsoft SQL Server - Integer Overflow

    Microsoft SQL Server contains an integer overflow vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 7.0 /10 High
    CVE-2026-77485 Auth required

    Microsoft SQL Server - Privilege Escalation

    Microsoft SQL Server contains a use after free vulnerability that allows authorized local attackers to elevate privileges by exploiting memory corruption.

  • 8.8 /10 High
    CVE-2026-77484 Auth required

    SQL Server - Insecure Deserialization

    SQL Server contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting authorized attackers execute code remotely over the network, exploit requires attacker authorization.

  • 8.8 /10 High
    CVE-2026-77483 Auth required

    Microsoft SQL Server - Authentication Bypass

    Microsoft SQL Server contains a broken authentication vulnerability caused by weak authentication mechanisms, letting authorized attackers elevate privileges over a network, exploit requires valid credentials.

  • 8.8 /10 High
    CVE-2026-77482 No auth

    Microsoft SQL Server - Remote Code Execution

    Microsoft SQL Server contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely over a network, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-77481 Auth required

    Microsoft SQL Server - Remote Code Execution

    Microsoft SQL Server contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers execute code remotely over a network, exploit requires valid credentials.

  • 8.8 /10 High
    CVE-2026-77480 Auth required

    SQL Server - Broken Access Control

    SQL Server contains a broken access control caused by insufficient granularity of access control, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 8.7 /10 High
    CVE-2026-77111 Auth required

    Adobe Commerce - Broken Access Control

    Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers with high privileges bypass security features and gain unauthorized write access, exploit requires high privileges.

  • 7.6 /10 High
    CVE-2026-77110 Auth required

    Adobe Commerce - Path Traversal

    Adobe Commerce contains a path traversal caused by improper limitation of pathname to restricted directories, letting attackers with high privileges bypass security features and access unauthorized files, exploit requires high privileges.

  • 8.6 /10 High
    CVE-2026-77109 No auth

    Adobe Commerce - Privilege Escalation

    Adobe Commerce contains an incorrect authorization vulnerability that allows attackers to escalate privileges and gain elevated access to restricted resources, exploit requires no user interaction.