High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 637 of 725

  • 8.1 /10 High
    CVE-2026-25687 No auth

    Zscaler Client Connector - Race Condition

    Zscaler Client Connector contains a race condition in the ZPA tunnel handler causing heap corruption, letting attackers cause denial of service or execute arbitrary code, exploit requires no special conditions.

  • 7.8 /10 High
    CVE-2026-23789

    Samsung Exynos - Use After Free

    Samsung Mobile Processor and Wearable Processor Exynos series contain a double-free vulnerability caused by improper cleanup of dma_buf references in the Exynos MFC encoder driver, letting attackers cause kernel memory corruption and potentially execute arbitrary code, exploit requires kernel-level access.

  • 7.1 /10 High
    CVE-2026-20683 No auth

    Apple - Authentication Bypass

    Apple iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27 contain an authentication bypass caused by improper state management in the Sign In With Apple flow, letting apps access user Apple Accounts, exploit requires app to use the Sign In With Apple authentication flow.

  • 7.1 /10 High
    CVE-2026-19816 Auth required

    PackageKit - Broken Access Control

    PackageKit with dnf5 backend contains a broken access control vulnerability caused by improper polkit authorization check skipping for SIMULATE flag in RepoRemove handler, letting unprivileged local users uninstall packages, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-19624 Auth required

    NetworkManager-l2tp - Command Injection

    NetworkManager-l2tp contains a command injection caused by unescaped attacker-controlled VPN connection properties in ipsec.conf, letting local unprivileged users escalate privileges to root via crafted L2TP VPN profiles.

  • 7.7 /10 High
    CVE-2026-19499

    GNU C Library - Buffer Overflow

    GNU C Library 2.38 to 2.44 contains a buffer overflow caused by strfmon and strfmon_l functions writing past the end of the output buffer with right-justified width padding, letting attackers cause memory corruption, exploit requires specific application code paths with vulnerable buffer sizes.

  • 7.5 /10 High
    CVE-2026-19290 No auth

    IBM Sterling File Gateway - Information Disclosure

    IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 contains an information disclosure vulnerability caused by improper access control, letting remote attackers obtain sensitive information, exploit requires no special privileges.

  • 8.2 /10 High
    CVE-2026-17467 No auth

    IBM Cloud Pak for Data System - Weak Cryptography

    IBM Cloud Pak for Data System Yosemite 1.0 3.0.5.2 contains weak cryptography caused by use of weak or deprecated cryptographic protocols, letting remote attackers obtain sensitive information, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-17416 No auth

    IBM App Connect Enterprise - Remote Code Execution

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 contain an insecure deserialization vulnerability caused by insecure deserialization, letting local attackers execute arbitrary code.

  • 7.8 /10 High
    CVE-2026-17156 No auth

    IBM App Connect Enterprise - Remote Code Execution

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 contain an insecure deserialization vulnerability caused by insecure deserialization, letting local attackers execute arbitrary code.

  • 7.8 /10 High
    CVE-2026-17133 No auth

    IBM App Connect Enterprise - Command Injection

    IBM App Connect Enterprise 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0 contain a command injection caused by improper neutralization of special elements in OS commands, letting local attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-16673 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special characters in the PxPeek name property, letting remote authenticated attackers execute arbitrary OS commands.

  • 8.8 /10 High
    CVE-2026-16466 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper handling of OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 7.7 /10 High
    CVE-2026-16432 Auth required

    IBM DataStage - XML External Entity Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an XML external entity injection caused by improper handling in PxXMLInput operator, letting remote authenticated attackers obtain sensitive information.

  • 8.8 /10 High
    CVE-2026-16428 Auth required

    IBM DataStage - Remote Code Execution

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a remote code execution caused by improper configuration of the XSLT transformation engine, letting remote authenticated attackers execute arbitrary code.