High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 626 of 628

  • 7.8 /10 High
    CVE-2026-28658 Auth required

    AccountsDb - Broken Access Control

    AccountsDb contains a broken access control vulnerability caused by a logic error in findMetaAuthUid, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28657 Auth required

    AppWidgetConfigActivityProxy - Broken Access Control

    AppWidgetConfigActivityProxy contains an unauthorized URI permission grant caused by a confused deputy in onActivityResult, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.3 /10 High
    CVE-2026-28656 Auth required

    DeviceAdminAdd - Clickjacking

    DeviceAdminAdd.java contains a tapjacking/overlay vulnerability caused by improper overlay handling in multiple functions, letting local attackers escalate privileges, exploit requires user interaction.

  • 7.8 /10 High
    CVE-2026-28655 Auth required

    Android RemoteViews - Privilege Escalation

    Android RemoteViews contains a background activity launch bypass caused by a logic error in multiple functions, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28653 Auth required

    rw_t3t.cc - Privilege Escalation

    rw_t3t.cc contains an out of bounds write caused by an integer overflow in multiple functions, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28650 Auth required

    WindowState - Broken Access Control

    WindowState.java contains a logic error in setHiddenWhileSuspended causing an overlay bypass, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28644 Auth required

    Android ActivityTaskManagerService - Broken Access Control

    Android ActivityTaskManagerService contains a permission bypass caused by a confused deputy in startNextMatchingActivity, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28642 Auth required

    ActivityStarter - Privilege Escalation

    ActivityStarter contains a logic error in executeRequest causing possible background activity launch, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28639 Auth required

    rw_mfc_handle_read_op - Privilege Escalation

    rw_mfc_handle_read_op in rw_mfc.cc contains an out of bounds write caused by a logic error, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28636 Auth required

    PickActivity - Privilege Escalation

    PickActivity contains a privilege escalation caused by a confused deputy bypassing the "Install unknown apps" security restriction in setupLayout, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28634 Auth required

    PhoneInterfaceManager - Privilege Escalation

    PhoneInterfaceManager contains a privilege escalation caused by a logic error in handleUssdRequest allowing sending USSD requests without permission, letting local attackers escalate privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28631 Auth required

    IntentForwarderActivity - Consent Bypass

    IntentForwarderActivity contains a consent bypass caused by tapjacking/overlay attack in buildMiniResolver, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.3 /10 High
    CVE-2026-28626 Auth required

    SetupPassthroughActivity - Open Redirect

    SetupPassthroughActivity contains an intent redirection vulnerability in onCreate of SetupPassthroughActivity.java, letting local attackers escalate privileges, exploit requires user interaction.

  • 7.8 /10 High
    CVE-2026-28624 Auth required

    Affected product - Privilege Escalation

    Affected product contains a local privilege escalation caused by confused deputy leading to improper file read/write permissions, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28620 Auth required

    Unknown Product - Broken Access Control

    An unspecified product contains a permissions bypass caused by unauthorized URI access in multiple locations, letting attackers escalate local privileges without additional execution privileges, exploit requires no user interaction.