Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 122 of 677

  • 7.5 /10 High
    CVE-2026-109832 No auth

    Gnome-remote-desktop - Denial of Service

    Gnome-remote-desktop in Red Hat Enterprise Linux contains a denial of service caused by unbounded busy loop handling retryable GnuTLS results in VNC TLS I/O handlers, letting remote attackers cause high CPU usage, exploit requires network access to VNC TLS listener.

  • 8.8 /10 High
    CVE-2026-109778

    Mozilla Firefox - Privilege Escalation

    Mozilla Firefox < 158 and Firefox ESR < 153.5 contain a privilege escalation caused by a vulnerability in the WebExtensions component, letting attackers escalate privileges, exploit requires unspecified conditions.

  • 9.3 /10 Critical
    CVE-2026-109758

    Perforce Helix Authentication Service - Authentication Bypass

    Perforce Helix Authentication Service 2022.1 - 2025.2 contains an authentication bypass caused by retaining the default SCIM bearer token in configuration, letting attackers authenticate to SCIM API and perform user/group operations, exploit requires reachable SCIM endpoint and knowledge of default token.

  • 8.8 /10 High
    CVE-2026-109756 No auth

    Firefox - Privilege Escalation

    Firefox < 158 and Firefox ESR < 153.5 contain a privilege escalation caused by a flaw in the DOM Navigation component, letting attackers escalate privileges, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-109743 Auth required

    Firefox - Privilege Escalation

    Firefox before 158 and Firefox ESR before 153.5 contain a privilege escalation caused by a flaw in the Panning and Zooming component, letting attackers escalate privileges, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-109739

    Firefox - Privilege Escalation

    Firefox contains a privilege escalation vulnerability in the WebExtensions component, letting attackers escalate their privileges, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-109709 No auth

    Firefox - Information Disclosure & Privilege Escalation

    Firefox < 158 and Firefox ESR < 153.5 contain an information disclosure and privilege escalation vulnerability in the Security: Process Sandboxing component, letting attackers gain elevated privileges and access sensitive information, exploit requires no special conditions.

  • 9.6 /10 Critical
    CVE-2026-109707 No auth

    Mozilla Firefox - Sandbox Escape

    Mozilla Firefox < 158 and Firefox ESR < 153.5 contain a use-after-free vulnerability in the Networking component, letting attackers escape sandbox restrictions, exploit requires crafted network interaction.

  • 9.6 /10 Critical
    CVE-2026-109705

    Mozilla Firefox - Use After Free

    Mozilla Firefox < 158 and Firefox ESR < 153.5 contain a use-after-free vulnerability caused by incorrect boundary conditions in the Networking component, letting attackers escape sandbox and bypass site isolation, exploit requires crafted network activity.

  • 8.8 /10 High
    CVE-2026-109704

    Mozilla Firefox - Privilege Escalation

    Mozilla Firefox contains a privilege escalation vulnerability in the Application Update component, letting attackers escalate their privileges, exploit requires unspecified conditions.

  • 7.6 /10 High
    CVE-2026-109687 Auth required

    Link Whisper INC Link Whisper Free - SQL Injection

    Link Whisper INC Link Whisper Free <= 0.9.7 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.

  • 8.8 /10 High
    CVE-2026-109676 No auth

    FreeRDP - Use After Free

    FreeRDP > 3.0.0-beta1 < 3.32.0 contains a use-after-free vulnerability caused by invalid smartcard connect operation in smartcard handling, letting attackers cause memory corruption or crashes, exploit requires triggering invalid connect.

  • 7.3 /10 High
    CVE-2026-109620 No auth

    SourceCodester Online Reviewer System - SQL Injection

    SourceCodester Online Reviewer System 1.0 contains a SQL injection caused by manipulation of username/password arguments in PDO::prepare in login/index.php, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-109607 No auth

    SourceCodester Online Exam System - SQL Injection

    SourceCodester Online Exam System 1.0 contains a SQL injection caused by manipulation of "username" and "pass" arguments in adminpanel/admin/query/loginExe.php Login Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-109606 No auth

    SourceCodester Art Gallery Management System - SQL Injection

    SourceCodester Art Gallery Management System 1.0 contains a SQL injection caused by manipulation of the "Name" argument in Action::save_user function in admin/admin_class.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.