High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 628 of 628

  • 7.8 /10 High
    CVE-2026-28590 Auth required

    Generic Product - Authentication Bypass

    Affected product contains an improper encryption key validation caused by a logic error in multiple locations, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28583 Auth required

    camera_metadata.c - Out of Bounds Write

    camera_metadata.c contains an out of bounds write caused by a logical error in validate_camera_metadata_structure, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-28572 Auth required

    InstallLaunch.kt - Clickjacking

    InstallLaunch.kt contains a tapjacking vulnerability caused by misleading UI due to overlay attack, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.4 /10 High
    CVE-2026-19651 No auth

    IBM Enterprise Build of Quarkus - Authorization Bypass

    IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 contains an authorization bypass caused by incorrect mapping of values to untrusted URL query parameters, letting attackers bypass authorization, exploit requires crafted URL query parameters.

  • 7.8 /10 High
    CVE-2026-0084 Auth required

    HostEmulationManager - Privilege Escalation

    HostEmulationManager contains a logic error in multiple functions causing possible background activity launch, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-0065 Auth required

    BackgroundLaunchProcessController - Privilege Escalation

    BackgroundLaunchProcessController contains a logic error in areBackgroundActivityStartsAllowed method, letting local users escalate privileges by launching activities in the background, exploit requires user execution privileges.