High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 81 of 552
- 7.8 /10 HighCVE-2026-78459 Auth required
Windows Internet Information Services - Privilege Escalation
Windows Internet Information Services contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers elevate privileges locally, exploit requires local access with authorization.
- 8.8 /10 HighCVE-2026-77910 Auth required
Microsoft Exchange Server - Broken Access Control
Microsoft Exchange Server contains a broken access control vulnerability caused by incorrect authorization, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-77902 No auth
Microsoft Office Excel - Remote Code Execution
Microsoft Office Excel contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-77496 No auth
Windows Imaging Component - Remote Code Execution
Windows Imaging Component contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 7.5 /10 HighCVE-2026-77207 No auth
Libreswan - Denial of Service
Libreswan contains a null pointer dereference caused by inconsistent handling of PKCS#7 blobs in IKE certificate authentication, letting remote attackers cause a denial of service via crafted IKE_AUTH packets, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-77206 No auth
Libreswan - Denial of Service
Libreswan contains a null pointer dereference caused by a fall-through in the IKEv2 state machine EAP handling code, letting remote attackers cause a denial of service by sending a malicious IKE_AUTH packet, exploit requires no authentication.
- 8.7 /10 HighCVE-2026-77100 No auth
Commvault MediaAgent - Denial of Service
Commvault MediaAgent contains a heap-based buffer overflow causing service availability issues, letting attackers cause denial of service, exploit requires no special privileges.
- 7.7 /10 HighCVE-2026-77096
CVFS - Command Injection
CVFS contains a command injection caused by missing authentication condition, letting attackers execute commands, exploit requires missing authentication condition.
- 7.1 /10 HighCVE-2026-77095 Auth required
Commvault CvFWD - Denial of Service
Commvault CvFWD contains a null pointer dereference causing service availability issues, letting attackers cause denial of service, exploit requires no special conditions.
- 7.1 /10 HighCVE-2026-77094 Auth required
Commvault CvFWD - Denial of Service
Commvault CvFWD contains an out-of-bounds write vulnerability causing service availability issues, letting attackers cause denial of service, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-77093 Auth required
Commvault CvFWD - Denial of Service
Commvault CvFWD contains an integer overflow causing service availability issues, letting attackers cause denial of service, exploit requires no special privileges.
- 8.7 /10 HighCVE-2026-77090 No auth
CVFS - XML External Entity Injection
CVFS contains an XML external entity injection caused by improper handling of XML external entity references, letting attackers disclose sensitive information, exploit requires crafted XML input.
- 7.1 /10 HighCVE-2026-76001 Auth required
ColdFusion - Server-Side Request Forgery
ColdFusion contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires conditions beyond attacker control.
- 7.5 /10 HighCVE-2026-75996 No auth
ColdFusion - Denial of Service
ColdFusion contains an uncontrolled resource consumption vulnerability caused by improper resource management, letting attackers exhaust system resources and cause application denial-of-service, exploit requires no user interaction.
- 8.4 /10 HighCVE-2026-75995 Auth required
ColdFusion - Improper Input Validation
ColdFusion contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires administrative network access.