High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 98 of 552
- 7.8 /10 HighCVE-2026-69471 Auth required
Windows Installer - Privilege Escalation
Windows Installer contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.5 /10 HighCVE-2026-69454 No auth
Microsoft Azure Attestation - Information Disclosure
Microsoft Azure Attestation service and Device Health Attestation Service contain an out-of-bounds read vulnerability, letting unauthorized attackers disclose information over a network, exploit requires network access.
- 7.1 /10 HighCVE-2026-69452 Auth required
Windows Enterprise App Management - Privilege Escalation
Windows Enterprise App Management contains a use after free vulnerability that allows an authorized attacker to elevate privileges over a network, exploit requires attacker to be authorized.
- 7.0 /10 HighCVE-2026-69387 Auth required
Windows Error Reporting - Privilege Escalation
Windows Error Reporting contains a use after free vulnerability that allows an authorized attacker to elevate privileges locally, exploit requires local access with authorization.
- 8.8 /10 HighCVE-2026-69370 No auth
Visual Studio Code - Command Injection
Visual Studio Code contains a command injection caused by improper neutralization of special elements in commands, letting unauthorized attackers execute code over a network, exploit requires network access.
- 8.0 /10 HighCVE-2026-69363 Auth required
Windows Error Reporting - Privilege Escalation
Windows Error Reporting contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers elevate privileges over a network, exploit requires attacker authorization.
- 7.8 /10 HighCVE-2026-69354 Auth required
Windows Error Reporting - Privilege Escalation
Windows Error Reporting contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 8.8 /10 HighCVE-2026-69326 No auth
Graphic Fonts - Remote Code Execution
Graphic Fonts contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.5 /10 HighCVE-2026-68883 Auth required
Microsoft SQL Server - Privilege Escalation
Microsoft SQL Server contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 7.8 /10 HighCVE-2026-68836 Auth required
Windows kernel32.dll - Privilege Escalation
Windows kernel32.dll contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 8.5 /10 HighCVE-2026-67625 Auth required
Microsoft SQL Server - Buffer Overflow
Microsoft SQL Server contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers execute code remotely over a network, exploit requires valid credentials.
- 8.8 /10 HighCVE-2026-65674 Auth required
SQL Server - Insecure Deserialization
SQL Server contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting authorized attackers execute code remotely over the network, exploit requires attacker authorization.
- 8.6 /10 HighCVE-2026-65198
Huawei openUBMC - Authentication Bypass
Huawei openUBMC contains a broken authentication caused by default SNMPv3 USM keys using the same value for authentication and privacy, letting attackers with the key authenticate and decrypt SNMPv3 traffic on any affected unit, exploit requires possession of the default key.
- 7.8 /10 HighCVE-2026-65180 Auth required
NVIDIA Megatron-LM - Remote Code Execution
NVIDIA Megatron-LM contains a remote code execution caused by loading a maliciously crafted checkpoint file, letting attackers execute code, escalate privileges, disclose information, and tamper data, exploit requires user to load malicious file.
- 8.6 /10 HighCVE-2026-65172 No auth
NVIDIA AIStore - Broken Access Control
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API, letting unauthenticated remote attackers access ETL information and control ETL jobs, exploit requires crafted GET or POST requests to AIStore proxy.