Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 112 of 677

  • 8.0 /10 High
    CVE-2026-69363 Auth required

    Windows Error Reporting - Privilege Escalation

    Windows Error Reporting contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers elevate privileges over a network, exploit requires attacker authorization.

  • 7.8 /10 High
    CVE-2026-69354 Auth required

    Windows Error Reporting - Privilege Escalation

    Windows Error Reporting contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.

  • 8.8 /10 High
    CVE-2026-69326 No auth

    Graphic Fonts - Remote Code Execution

    Graphic Fonts contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-69227 No auth

    Portal for ArcGIS - Authentication Bypass

    Portal for ArcGIS contains an authentication bypass caused by unauthenticated access to certain /portaladmin/local API endpoints, letting unauthenticated attackers access administrative functionality, exploit requires specific conditions.

  • 8.5 /10 High
    CVE-2026-68883 Auth required

    Microsoft SQL Server - Privilege Escalation

    Microsoft SQL Server contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 7.8 /10 High
    CVE-2026-68836 Auth required

    Windows kernel32.dll - Privilege Escalation

    Windows kernel32.dll contains a heap-based buffer overflow caused by improper memory handling, letting authorized local attackers elevate privileges, exploit requires local access with authorization.

  • 8.5 /10 High
    CVE-2026-67625 Auth required

    Microsoft SQL Server - Buffer Overflow

    Microsoft SQL Server contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers execute code remotely over a network, exploit requires valid credentials.

  • 8.8 /10 High
    CVE-2026-65674 Auth required

    SQL Server - Insecure Deserialization

    SQL Server contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting authorized attackers execute code remotely over the network, exploit requires attacker authorization.

  • 8.6 /10 High
    CVE-2026-65198

    Huawei openUBMC - Authentication Bypass

    Huawei openUBMC contains a broken authentication caused by default SNMPv3 USM keys using the same value for authentication and privacy, letting attackers with the key authenticate and decrypt SNMPv3 traffic on any affected unit, exploit requires possession of the default key.

  • 7.8 /10 High
    CVE-2026-65180 Auth required

    NVIDIA Megatron-LM - Remote Code Execution

    NVIDIA Megatron-LM contains a remote code execution caused by loading a maliciously crafted checkpoint file, letting attackers execute code, escalate privileges, disclose information, and tamper data, exploit requires user to load malicious file.

  • 9.1 /10 Critical
    CVE-2026-65173 No auth

    NVIDIA AIStore - Broken Authentication

    NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint, letting unauthenticated remote attackers submit crafted token-revocation lists, leading to data tampering and denial of service.

  • 8.6 /10 High
    CVE-2026-65172 No auth

    NVIDIA AIStore - Broken Access Control

    NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API, letting unauthenticated remote attackers access ETL information and control ETL jobs, exploit requires crafted GET or POST requests to AIStore proxy.

  • 8.6 /10 High
    CVE-2026-65170 No auth

    NVIDIA AIStore - Server Side Request Forgery

    NVIDIA AIStore for Linux contains a server side request forgery caused by crafted original URL in experimental HT backend, letting unauthenticated remote attackers disclose information, exploit requires crafted URL.

  • 8.1 /10 High
    CVE-2026-65164 No auth

    NVIDIA AIStore - Path Traversal

    NVIDIA AIStore for Linux contains a path traversal caused by improper limitation of pathname in dSort archive extraction, letting remote attackers create or overwrite files, execute code, disclose information, tamper data, and cause denial of service, exploit requires crafted archive member names.

  • 10.0 /10 Critical
    CVE-2026-65162

    NVIDIA AIStore - Remote Code Execution & Privilege Escalation & Information Disclosure & Data Tampering & Denial of Service

    NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings, letting remote attackers execute code, escalate privileges, disclose information, tamper data, and cause denial of service, exploit requires access to the vulnerable API.