Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 137 of 677

  • 8.6 /10 High
    CVE-2026-102250 Auth required

    Generic Product - Authentication Bypass

    An unspecified product contains an insufficient verification of data authenticity vulnerability caused by lack of proper firmware validation during update, letting authorized admin users upload modified firmware and gain control over the device, exploit requires admin privileges.

  • 9.6 /10 Critical
    CVE-2026-102238 No auth

    Visual Studio Code - Path Traversal

    Visual Studio Code contains a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory, letting unauthorized attackers execute code over a network, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-102235 No auth

    Visual Studio Code - Remote Code Execution

    Visual Studio Code contains a code execution vulnerability caused by improper encoding or escaping of output, letting unauthorized attackers execute code over a network, exploit requires network access.

  • 7.4 /10 High
    CVE-2026-102234 No auth

    Visual Studio Code - Authentication Bypass

    Visual Studio Code contains a security feature bypass caused by reliance on untrusted inputs in a security decision, letting unauthorized attackers bypass security over a network, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-102233 No auth

    Visual Studio Code - Broken Access Control

    Visual Studio Code contains a broken access control caused by missing authorization checks, letting unauthorized local attackers bypass security features, exploit requires local access.

  • 7.0 /10 High
    CVE-2026-102232

    Visual Studio Code - Broken Access Control

    Visual Studio Code contains a broken access control vulnerability caused by incorrect authorization, letting unauthorized local attackers bypass security features, exploit requires local access.

  • 7.7 /10 High
    CVE-2026-102231 No auth

    Visual Studio Code - Authentication Bypass

    Visual Studio Code contains a security feature bypass caused by improper resolution of path equivalence, letting unauthorized local attackers bypass security controls, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-102227 Auth required

    Microsoft Windows Resilient File System - Buffer Overflow

    Microsoft Windows Resilient File System (ReFS) contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers execute code locally, exploit requires local access with authorization.

  • 8.8 /10 High
    CVE-2026-102226 Auth required

    Dynamics Business Central - Path Traversal

    Dynamics Business Central contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 8.8 /10 High
    CVE-2026-102225 No auth

    Windows Text Shaping - Remote Code Execution

    Windows Text Shaping contains an out-of-bounds read vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-102220 Auth required

    Windows VHD miniport driver - Privilege Escalation

    Windows VHD miniport driver contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory corruption.

  • 7.8 /10 High
    CVE-2026-102218 Auth required

    Windows Universal Disk Format File System Driver - Privilege Escalation

    Windows Universal Disk Format File System Driver contains a heap-based buffer overflow, letting authorized local attackers elevate privileges, exploit requires local access with authorization.

  • 8.8 /10 High
    CVE-2026-102217 Auth required

    WebDAV - Broken Access Control

    WebDAV contains a broken access control vulnerability caused by improper resolution of path equivalence, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 7.8 /10 High
    CVE-2026-102216 Auth required

    Windows StateRepository API - Privilege Escalation

    Windows StateRepository API contains a type confusion vulnerability caused by access of resource using incompatible type, letting authorized attackers elevate privileges locally, exploit requires local access with authorization.

  • 7.8 /10 High
    CVE-2026-102215 Auth required

    Windows Universal Disk Format File System Driver - Privilege Escalation

    Windows Universal Disk Format File System Driver contains a heap-based buffer overflow, letting authorized local attackers elevate privileges, exploit requires local access with authorization.