Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 16 of 677
- 8.8 /10 HighCVE-2026-108444 No auth
CVE-2026-108444
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
- 7.5 /10 HighCVE-2026-108116 No auth
Kendo UI for jQuery - Information Disclosure
Kendo UI for jQuery < v2026.3.1015 contains an information disclosure vulnerability caused by specially crafted filter values in the PivotGrid XMLA transport altering MDX predicates or injecting XML markup into SOAP requests, letting attackers expose data accessible through the XMLA connection, exploit requires crafted filter values.
- 8.7 /10 HighCVE-2026-108082 No auth
Symfony HTTP Foundation - Denial of Service
Symfony HTTP Foundation < 5.4.54, < 6.4.46, < 7.4.19, and < 8.1.7 contains a denial of service caused by exponential backtracking in HeaderUtils::split() when parsing Cache-Control headers, letting remote attackers cause high CPU usage, exploit requires sending crafted HTTP requests.
- 7.5 /10 HighCVE-2026-107416 No auth
Webba Plugins Webba Booking - Authorization Bypass
Webba Plugins Webba Booking <= 6.5.2 contains an authorization bypass caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires user interaction.
- 8.4 /10 HighCVE-2026-104025 No auth
PeaZip - Path Traversal & Remote Code Execution
PeaZip <= 11.2.0 on Windows contains a path traversal vulnerability in the execute_obj function of the archive object viewer, caused by improper validation of archive entry names, letting attackers execute arbitrary programs present on the victim's system via crafted archive preview, exploit requires victim to preview a crafted archive entry.
- 8.5 /10 HighCVE-2026-103509 Auth required
P4 Search - Privilege Escalation
P4 Search (formerly Helix Search) <= 2026.4.2 contains a privilege escalation vulnerability caused by returning stored credentials in cleartext through its configuration API, letting users with administrative privileges escalate privileges, exploit requires administrative access.
- 7.3 /10 HighCVE-2026-103508 Auth required
Perforce P4 Search - Remote Code Execution
Perforce P4 Search <= 2026.4.2 contains an unrestricted file write caused by crafted logging configuration, letting authenticated admin users execute code as the service account, exploit requires admin privileges.
- 8.2 /10 HighCVE-2026-103224 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains an out-of-memory vulnerability caused by unbounded direct-memory allocation in MySQL message decoder, letting malicious MySQL servers cause client crashes before authentication completes.
- 8.2 /10 HighCVE-2026-103223 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains an out-of-memory vulnerability caused by lack of maximum validation on PostgreSQL message length in io.vertx:vertx-pg-client, letting malicious or man-in-the-middle PostgreSQL servers cause unbounded memory allocation, exploit requires connection to a malicious PostgreSQL server.
- 8.7 /10 HighCVE-2026-102477 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains a denial of service vulnerability caused by improper maximum message size validation on compressed gRPC messages in io.vertx:vertx-grpc-server, letting attackers trigger excessive memory allocation, exploit requires sending crafted compressed messages.
- 8.7 /10 HighCVE-2026-102475 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains a denial of service caused by unbounded heap allocation in the HTTP proxy body transformer interceptor, letting attackers cause server resource exhaustion, exploit requires use of intercepting body transformer.
- 9.2 /10 CriticalCVE-2026-102469 No auth
Eclipse Vert.x - Insecure Deserialization
Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0 contain an insecure deserialization vulnerability in vertx-db2-client caused by deserializing UDT column data without filtering, letting a malicious or MITM DRDA server execute remote code or cause DoS, exploit requires attacker-controlled DRDA server or MITM position.
- 8.7 /10 HighCVE-2026-102467 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains a denial of service vulnerability caused by missing maximum byte allocation limits during WebSocket frame decompression in io.vertx:vertx-core, letting attackers perform DoS via zip bomb, exploit requires network access.
- 8.2 /10 HighCVE-2026-102466 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contain a denial of service caused by lack of upper-bound validation on server-declared column count in vertx-mysql-client, letting attackers cause OutOfMemoryError and crash the event loop, exploit requires man-in-the-middle or malicious MySQL server.
- 8.2 /10 HighCVE-2026-102465 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x Redis client in versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains a denial of service caused by unbounded array pre-allocation in the RESP parser, letting attackers cause event loop crashes via crafted RESP responses, exploit requires attacker to control or intercept Redis server responses.