High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 632 of 725

  • 8.2 /10 High
    CVE-2026-65838

    Skipper - Authorization Bypass

    Skipper < 0.27.35 contains an authorization bypass caused by incomplete request body parsing in opaAuthorizeRequestWithBody filter, letting attackers bypass deny-on-presence Rego policies with oversized Content-Length requests, exploit requires policy logic that does not reject truncated bodies.

  • 8.1 /10 High
    CVE-2026-65415 No auth

    Apple - Race Condition

    Apple iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 contain a race condition caused by insufficient validation, letting local users cause system termination or read kernel memory, exploit requires local access.

  • 7.5 /10 High
    CVE-2026-65410 No auth

    Apple - Denial of Service

    Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a denial of service caused by insufficient checks, letting apps cause unexpected system termination, exploit requires app execution.

  • 7.8 /10 High
    CVE-2026-65398 Auth required

    Apple - Out of Bounds Read/Write

    Apple iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 contain an out-of-bounds read/write caused by insufficient bounds checking, letting apps cause system termination or kernel memory corruption, exploit requires malicious app.

  • 8.8 /10 High
    CVE-2026-65391 No auth

    Apple Safari - Out of Bounds Write

    Apple Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS contain an out-of-bounds write caused by insufficient bounds checking in web content processing, letting attackers cause memory corruption remotely, exploit requires crafted web content.

  • 8.8 /10 High
    CVE-2026-65390 No auth

    Apple Safari - Integer Overflow

    Apple Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS contain an integer overflow caused by insufficient input validation when processing web content, letting attackers cause memory corruption, exploit requires malicious web content.

  • 7.5 /10 High
    CVE-2026-65378 No auth

    Apple macOS - Broken Access Control

    Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a broken access control caused by improper state management, letting unauthorized apps access sensitive user data, exploit requires app execution.

  • 7.5 /10 High
    CVE-2026-65375 No auth

    Apple macOS - Denial of Service

    Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.6 contain a denial of service caused by improper authentication, letting apps cause unexpected system termination, exploit requires app execution.

  • 8.8 /10 High
    CVE-2026-65374 PoC publicNo auth

    Apple macOS - Remote Code Execution

    Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a remote code execution caused by memory corruption due to insufficient validation when connecting to a malicious WebDAV server, letting remote attackers execute code, exploit requires connection to malicious WebDAV server.

  • 7.5 /10 High
    CVE-2026-65364 No auth

    Apple macOS - Denial of Service

    Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain an out-of-bounds read caused by insufficient bounds checking, letting remote attackers cause denial of service, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-65362 Auth required

    Apple macOS - Privilege Escalation

    Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a privilege escalation caused by insufficient privilege checks, letting local apps gain root privileges, exploit requires local app execution.

  • 7.1 /10 High
    CVE-2026-65359 Auth required

    Apple - Out of Bounds Read

    Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain an out-of-bounds read caused by insufficient bounds checking, letting local users cause system termination or read kernel memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-65357 Auth required

    Apple - Buffer Overflow

    Apple iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 contain a memory corruption vulnerability caused by improper memory handling, letting apps cause system termination or write kernel memory, exploit requires malicious app execution.

  • 8.2 /10 High
    CVE-2026-65354 Auth required

    Apple iOS & iPadOS & macOS - Privilege Escalation

    Apple iOS 27, iPadOS 27, and macOS Golden Gate 27 contain a sandbox escape vulnerability caused by insufficient permissions restrictions, letting malicious apps break out of their sandbox, exploit requires malicious app installation.

  • 7.8 /10 High
    CVE-2026-65344 No auth

    Apple - Denial of Service

    Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, and visionOS 27 contain an out-of-bounds write caused by improper bounds checking in video file processing, letting attackers cause denial of service by crashing the app, exploit requires processing a maliciously crafted video file.