High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 603 of 628

  • 7.5 /10 High
    CVE-2026-77108 No auth

    Adobe Commerce - Broken Access Control

    Adobe Commerce contains an incorrect authorization vulnerability caused by flawed access control, letting attackers escalate privileges and access sensitive information, exploit requires no user interaction.

  • 8.2 /10 High
    CVE-2026-76202 No auth

    Adobe Commerce - Broken Access Control

    Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges and access sensitive information, exploit requires no user interaction.

  • 8.6 /10 High
    CVE-2026-76199 No auth

    Photoshop Desktop - Remote Code Execution

    Photoshop Desktop contains an uncontrolled search path element vulnerability caused by improper handling of search paths, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.4 /10 High
    CVE-2026-76196 No auth

    Photoshop Mobile - Session Fixation

    Photoshop Mobile contains a session fixation vulnerability caused by improper session management, letting attackers escalate privileges by exploiting user interaction with a malicious webpage.

  • 8.2 /10 High
    CVE-2026-76191 Auth required

    Animate - Code Injection

    Animate contains a code injection vulnerability caused by improper control of code generation, letting low-privileged attackers execute arbitrary code via malicious file, exploit requires user interaction.

  • 8.6 /10 High
    CVE-2026-76190 No auth

    ColdFusion - Expression Language Injection

    ColdFusion contains an eval injection vulnerability caused by improper neutralization of directives in dynamically evaluated code, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-75999 Auth required

    ColdFusion - Remote Code Execution

    ColdFusion contains an improper input validation vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.5 /10 High
    CVE-2026-75998 No auth

    ColdFusion - Broken Access Control

    ColdFusion contains an improper access control vulnerability that allows attackers to read arbitrary files outside intended access scope, letting attackers access sensitive files without user interaction.

  • 8.5 /10 High
    CVE-2026-75993 No auth

    ColdFusion - Reflected XSS

    ColdFusion contains a reflected XSS caused by injection of malicious scripts into a web page, letting attackers execute scripts and potentially gain elevated access, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-75992 No auth

    Illustrator - Remote Code Execution

    Illustrator contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 8.6 /10 High
    CVE-2026-75991 No auth

    Illustrator - Remote Code Execution

    Illustrator contains an improper input validation vulnerability caused by processing malicious files, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 8.6 /10 High
    CVE-2026-75990 No auth

    Illustrator - Broken Access Control

    Illustrator contains an incorrect authorization vulnerability caused by improper access control, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-75863 No auth

    Photoshop Desktop - Remote Code Execution

    Photoshop Desktop contains an integer overflow caused by improper handling of file data, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-75862 No auth

    Adobe Photoshop Desktop - Remote Code Execution

    Adobe Photoshop Desktop contains an integer overflow caused by improper handling of file data, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-75771 No auth

    Adobe Photoshop Desktop - Remote Code Execution

    Adobe Photoshop Desktop contains an integer overflow caused by improper handling of file data, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.