Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 17 of 677
- 8.2 /10 HighCVE-2026-102464 No auth
Eclipse Vert.x MQTT - Denial of Service
Eclipse Vert.x MQTT (vertx-mqtt) versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contain an unbounded memory growth vulnerability caused by unlimited retention of inbound QoS 2 PUBLISH messages in an internal map, letting a malicious MQTT broker cause denial of service by exhausting memory, exploit requires a malicious or compromised MQTT broker.
- 8.2 /10 HighCVE-2026-102463 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contain a denial of service caused by unbounded array allocation in vertx-pg-client's binary array decoder, letting attackers crash the client via OutOfMemoryError, exploit requires attacker to control or intercept PostgreSQL server responses.
- 8.2 /10 HighCVE-2026-102462 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains an out-of-memory vulnerability caused by unbounded aggregation of inbound TDS packets in the Vert.x MSSQL client, letting malicious or man-in-the-middle SQL Servers cause client crashes before authentication completes.
- 8.7 /10 HighCVE-2026-102461 No auth
Eclipse Vert.x - Denial of Service
Eclipse Vert.x 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains a denial of service caused by inefficient uniqueItems keyword validation in io.vertx:vertx-json-schema, letting remote unauthenticated attackers consume excessive CPU, exploit requires sending a moderately-sized JSON array.
- 7.0 /10 HighCVE-2026-101311 Auth required
bhyve - Remote Code Execution & Denial of Service
bhyve contains a race condition and improper validation in framebuffer and RFB modules, letting a malicious guest crash the bhyve process or execute arbitrary code in host userspace, exploit requires guest VM access.
- 7.5 /10 HighCVE-2026-101290 No auth
Affected Application - Denial of Service
An affected application contains an out-of-bounds read caused by insufficient validation of packet length, letting remote attackers cause denial-of-service by crashing the application, exploit requires crafted network packet.
- 9.3 /10 CriticalCVE-2026-101287 No auth
Stela - Authentication Bypass
Stela < 1.60.1 contains an authentication bypass caused by unvalidated manipulation of the "authProcess" cookie storing userId and validSteps, letting remote attackers impersonate any account including SUPER_ADMIN, exploit requires no valid credentials or user interaction.
- 7.5 /10 HighCVE-2026-0993 No auth
SODOLA SL902-SWTGW124AS - Denial of Service
SODOLA SL902-SWTGW124AS firmware < 200.2.12 contains a buffer overflow caused by an oversized boundary value in the Content-Type header of a multipart/form-data POST request, letting unauthenticated remote attackers cause denial of service.
- 7.5 /10 HighCVE-2025-68404 No auth
QuRouter - Race Condition
QuRouter contains a time-of-check time-of-use (TOCTOU) race condition vulnerability, letting remote attackers compromise system security, exploit requires no special privileges.
- 7.7 /10 HighCVE-2025-66275 Auth required
Video Station - Path Traversal
Video Station < 5.8.5 contains a path traversal caused by insufficient validation of file paths, letting remote attackers with user accounts read arbitrary files, exploit requires user authentication.
- 7.7 /10 HighCVE-2025-66272 Auth required
Video Station - Path Traversal
Video Station < 5.8.5 contains a path traversal caused by insufficient input validation, letting remote attackers with user accounts read arbitrary files, exploit requires attacker to have a user account.
- 8.5 /10 HighCVE-2024-22031 Auth required
Rancher - Broken Access Control
Rancher contains a broken access control vulnerability caused by allowing project creation with duplicate names across clusters, letting users escalate privileges by accessing projects in different clusters, exploit requires project creation ability.
- 8.0 /10 HighCVE-2023-32198 Auth required
Steve - Man-in-the-Middle
Steve contains a man-in-the-middle vulnerability caused by using an insecure TLS option that does not validate remote server certificates, letting attackers intercept and modify communications, exploit requires network access.
- 9.0 /10 CriticalCVE-2026-111283 No auth
BMC Helix Network Management - Authentication Bypass
BMC Helix Network Management on-prem < 26.3.01 contains an authentication bypass caused by improper SAML single sign-on validation, letting unauthenticated attackers log in as local administrator, exploit requires SAML SSO configuration.
- 9.3 /10 CriticalCVE-2026-102764 CISA KEVNo auth
BeyondTrust Remote Support - Broken Access Control
BeyondTrust Remote Support contains a broken access control vulnerability caused by inadequate validation of message origins in internal components, letting attackers perform unauthorized file operations on the appliance, exploit requires specific message conditions.