High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 92 of 552
- 7.5 /10 HighCVE-2026-70058 No auth
Windows DHCP Server - Remote Code Execution
Windows DHCP Server contains an out-of-bounds write vulnerability allowing unauthorized attackers to execute code remotely over the network, exploit requires network access.
- 7.0 /10 HighCVE-2026-70056 Auth required
Windows Update Service - Privilege Escalation
Windows Update Service contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory corruption.
- 7.8 /10 HighCVE-2026-70054 Auth required
Windows NetBIOS - Privilege Escalation
Windows NetBIOS contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-70052 Auth required
Windows PowerShell - Integer Overflow
Windows PowerShell contains an integer overflow caused by improper handling of integer values, letting authorized attackers execute code locally, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-70051 Auth required
Windows SmartScreen - Privilege Escalation
Windows SmartScreen contains a type confusion vulnerability caused by access of resource using incompatible type, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 8.0 /10 HighCVE-2026-70049 Auth required
Microsoft Configuration Manager - SQL Injection
Microsoft Configuration Manager contains an SQL Injection caused by improper neutralization of special elements in SQL commands, letting authorized attackers elevate privileges over an adjacent network, exploit requires attacker authorization.
- 7.8 /10 HighCVE-2026-70048 Auth required
Microsoft Windows Resilient File System - Privilege Escalation
Microsoft Windows Resilient File System (ReFS) contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.0 /10 HighCVE-2026-70045 Auth required
Windows Work Folders - Privilege Escalation
Windows Work Folders contains a use after free vulnerability that allows an authorized local attacker to elevate privileges by exploiting memory management flaws.
- 8.1 /10 HighCVE-2026-70038 No auth
Windows iSCSI - Remote Code Execution
Windows iSCSI contains a use after free vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-70035 No auth
.NET Framework - Insecure Deserialization
.NET Framework contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting unauthorized attackers execute code remotely, exploit requires network access.
- 7.5 /10 HighCVE-2026-70033 No auth
Microsoft Remote Desktop Gateway Service - Denial of Service
Microsoft Remote Desktop Gateway Service contains a denial of service caused by missing release of memory after effective lifetime, letting unauthorized attackers cause service disruption remotely, exploit requires network access.
- 7.5 /10 HighCVE-2026-70031 No auth
Windows iSCSI - Denial of Service
Windows iSCSI contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers cause denial of service over a network, exploit requires network access.
- 7.8 /10 HighCVE-2026-70027 Auth required
Windows Subsystem for Linux - Privilege Escalation
Windows Subsystem for Linux contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.0 /10 HighCVE-2026-70026 Auth required
Windows Secure Kernel Mode - Use After Free
Windows Secure Kernel Mode contains a use after free vulnerability, letting authorized local attackers elevate privileges, exploit requires local authorized access.
- 7.8 /10 HighCVE-2026-70023 Auth required
Windows Hyper-V - Privilege Escalation
Windows Hyper-V contains a use after free vulnerability that allows an authorized local attacker to elevate privileges by exploiting memory management flaws.