Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 136 of 677
- 8.8 /10 HighCVE-2026-102870 No auth
ASP.NET Core - Command Injection
ASP.NET Core contains a code injection vulnerability caused by improper control of code generation, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102869 No auth
.NET & Visual Studio - Privilege Escalation
.NET and Visual Studio contain a type confusion vulnerability caused by access of resource using incompatible type, letting unauthorized attackers elevate privileges over a network, exploit requires network access.
- 8.1 /10 HighCVE-2026-102866 No auth
Microsoft Office SharePoint - Authentication Bypass
Microsoft Office SharePoint contains a broken authentication caused by improper verification of cryptographic signature, letting unauthorized attackers elevate privileges over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-102863 Auth required
Microsoft Office SharePoint - Command Injection
Microsoft Office SharePoint contains a code injection caused by improper control of code generation, letting authorized attackers elevate privileges over a network, exploit requires attacker authorization.
- 8.8 /10 HighCVE-2026-102862 Auth required
Microsoft Office SharePoint - Broken Access Control
Microsoft Office SharePoint contains a broken access control caused by incorrect authorization, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-102861 Auth required
Microsoft Office SharePoint - Privilege Escalation
Microsoft Office SharePoint contains a broken access control caused by missing authorization checks, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-102860 Auth required
Microsoft Office SharePoint - Privilege Escalation
Microsoft Office SharePoint contains a broken access control vulnerability caused by improper access control, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-102858 No auth
Microsoft Office OneNote - Remote Code Execution
Microsoft Office OneNote contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102857 No auth
Microsoft Office Visio - Remote Code Execution
Microsoft Office Visio contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102856 No auth
Microsoft Office Visio - Remote Code Execution
Microsoft Office Visio contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102855 No auth
Microsoft Office Visio - Remote Code Execution
Microsoft Office Visio contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102850 No auth
Microsoft Office Access - Remote Code Execution
Microsoft Office Access contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-102849 No auth
Microsoft Office Access - Remote Code Execution
Microsoft Office Access contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 7.5 /10 HighCVE-2026-102599 No auth
Engine.IO - Denial of Service
Engine.IO 6.6.0 to 6.6.10 contains a denial of service caused by improper handling of transport upgrade requests with different or omitted EIO query parameters, letting malicious clients trigger uncaught exceptions and terminate the Node.js process, exploit requires a crafted upgrade request.
- 7.2 /10 HighCVE-2026-102562 No auth
AcyMailing WordPress Plugin - Stored XSS
AcyMailing WordPress plugin <= 11.1.0 contains a stored cross-site scripting caused by insufficient sanitization in customField[] parameter in public frontusers::subscribe endpoint, letting unauthenticated attackers inject scripts executed when users access the online-archive URL.