Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 146 of 681
- 7.5 /10 HighCVE-2026-100118 No auth
CAI Content Credentials - Authentication Bypass
CAI Content Credentials contains an improper certificate validation vulnerability that allows attackers to bypass security features and gain unauthorized write access, exploit requires no user interaction.
- 7.5 /10 HighCVE-2026-100117 No auth
CAI Content Credentials - Broken Access Control
CAI Content Credentials contains an improper input validation vulnerability that allows attackers to bypass security features and gain unauthorized write access, exploit requires no user interaction.
- 7.5 /10 HighCVE-2026-100115 No auth
CAI Content Credentials - Broken Access Control
CAI Content Credentials contains an improper access control vulnerability that allows attackers to bypass security features and gain unauthorized write access, exploit requires no user interaction.
- 7.5 /10 HighCVE-2026-100114 No auth
CAI Content Credentials - Broken Access Control
CAI Content Credentials contains an improper access control vulnerability that allows attackers to bypass security features and gain unauthorized write access, exploit requires no user interaction.
- 7.5 /10 HighCVE-2026-100113 No auth
CAI Content Credentials - Security Feature Bypass
CAI Content Credentials contains an improper input validation vulnerability that allows attackers to bypass security features and gain unauthorized write access, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-100112 No auth
Adobe Photoshop Desktop - Remote Code Execution
Adobe Photoshop Desktop contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 7.8 /10 HighCVE-2026-100111 No auth
Photoshop Desktop - Remote Code Execution
Photoshop Desktop contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 8.3 /10 HighCVE-2025-58774 Auth required
AMI APTIOV - Buffer Overflow
AMI APTIOV BIOS contains a buffer overflow caused by buffer access with incorrect length value, letting local attackers execute arbitrary code, exploit requires local access.
- 7.1 /10 HighCVE-2025-58773 Auth required
AMI APTIOV - Buffer Overflow
AMI APTIOV BIOS contains an out-of-bounds write vulnerability caused by improper bounds checking, letting local attackers cause buffer overflows, memory corruption, and arbitrary code execution, exploit requires local access.
- 8.2 /10 HighCVE-2025-58772 Auth required
AMI APTIOV - Buffer Overflow
AMI APTIOV contains a buffer overflow vulnerability in BIOS, letting local attackers cause memory corruption and execute arbitrary code, exploit requires local access.
- 7.1 /10 HighCVE-2025-58771 Auth required
AMI APTIOV - Integer Overflow
AMI APTIOV BIOS contains an integer overflow caused by improper handling of integer values, letting local attackers cause buffer overflows, memory corruption, and arbitrary code execution, exploit requires local access.
- 8.8 /10 HighCVE-2025-57739 Auth required
Fortinet FortiMail - SQL Injection
Fortinet FortiMail 7.2.0 through 7.2.8, 7.4.0 through 7.4.5, and 7.6.0 through 7.6.3 contain an SQL injection caused by improper neutralization of special elements in SQL commands, letting authenticated attackers execute unauthorized code or commands via crafted HTTP/HTTPS requests.
- 8.8 /10 HighCVE-2025-46773 Auth required
Fortinet FortiAnalyzer - SQL Injection
Fortinet FortiAnalyzer 7.2 all versions, 7.4.0 through 7.4.7, and 7.6.0 through 7.6.4, including FortiAnalyzer Cloud versions 7.2.1 through 7.2.11, 7.4.1 through 7.4.7, and 7.6.2 through 7.6.4 contain an SQL injection caused by improper neutralization of special elements in SQL commands, letting low privileged users execute arbitrary commands via crafted requests.
- 9.1 /10 CriticalCVE-2024-34324
ProPhoenix Law RMS - Authentication Bypass
ProPhoenix Law RMS v2022.2403.3.101 contains a session hijacking vulnerability caused by injection of a crafted 24-character string into the ASP.NET_SessionId cookie, letting attackers hijack user sessions, exploit requires crafted cookie injection.
- 10.0 /10 CriticalCVE-2024-34323 No auth
ProPhoenix Law RMS - Insecure Direct Object Reference
ProPhoenix Law RMS v2022.2403.3.101 contains an insecure direct object reference caused by improper access control on the usrLogin$hdnPFID parameter, letting attackers access sensitive information via crafted HTTP requests.