Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 186 of 681

  • 8.2 /10 High
    CVE-2026-90983 No auth

    Hayat Health Facilities Inc. Hayat Mobile - Authentication Bypass

    Hayat Health Facilities Inc. Hayat Mobile 3.3.0 to before 3.4.0 contains an authentication bypass caused by use of client-side authentication, letting attackers bypass authentication, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-86405 No auth

    Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module - Authentication Bypass

    Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module >= 26.8.1 < 26.9.1 contains a signature spoofing vulnerability caused by improper cryptographic signature verification, letting attackers spoof signatures, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-85531 No auth

    Sipay OpenCart Virtual POS Module - Authentication Bypass

    Sipay OpenCart Virtual POS Module >= 26.8.2 < 26.9.1 contains a signature spoofing vulnerability caused by improper cryptographic signature verification, letting attackers bypass signature validation, exploit requires crafted signature input.

  • 8.5 /10 High
    CVE-2026-8374

    SwitchBot Door Lock Series - Authentication Bypass

    SwitchBot Door Lock Series contains an authentication bypass caused by misuse and misconfiguration in Bluetooth communication, letting attackers bypass electronic lock and access controls via manipulated protocol, exploit requires proximity to the device.

  • 7.2 /10 High
    CVE-2026-81929 No auth

    Ocean Pro Demos & Ocean eComm Treasure Box - Stored XSS

    Ocean Pro Demos and Ocean eComm Treasure Box WordPress plugins <= 1.5.4 and 1.8.0 contain a stored cross-site scripting caused by insufficient authorization, input sanitization, and output escaping in Popup Builder's save_popup_content AJAX action, letting unauthenticated attackers inject scripts into published Gutenberg popups, exploit requires valid premium license, Popup Builder module, and published popup.

  • 9.8 /10 Critical
    CVE-2026-78835

    Rocket Software Rocket Remote Desktop - Authentication Bypass

    Rocket Software Rocket Remote Desktop 18.0.8583.1 contains an insufficiently protected credentials vulnerability caused by inadequate credential protection, letting attackers potentially access sensitive credentials, exploit requires attacker access to stored credentials.

  • 9.8 /10 Critical
    CVE-2026-78797 No auth

    iStoreOS - Remote Code Execution

    iStoreOS istoreos-24.10.7 and before contains a remote code execution caused by improper handling of task_id in tasks-lib.lua, letting remote attackers execute arbitrary code, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-78795 No auth

    Netcore B11 - Information Disclosure

    Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router <= v1.3.241114.024540 contains an information disclosure vulnerability allowing remote attackers to obtain sensitive information without authentication.

  • 8.1 /10 High
    CVE-2026-7827 No auth

    FalkorDB - Buffer Overflow

    FalkorDB < 4.18.4 contains a stack-based buffer overflow caused by improper bounds checking in _RdbLoadEntity function of RDB graph decoders, letting remote attackers issuing Redis replication commands cause denial of service or remote code execution by supplying crafted RDB streams.

  • 9.1 /10 Critical
    CVE-2026-7826 No auth

    FalkorDB - Out-of-Bounds Read

    FalkorDB < 4.18.4 contains a heap-based out-of-bounds read caused by improper bounds checking in BufferSerializerIOv2_ReadBuffer function, letting remote attackers issuing Redis replication commands cause denial of service or memory disclosure, exploit requires ability to send replication commands.

  • 7.5 /10 High
    CVE-2026-78025 No auth

    Dell Secure Connect Gateway Policy Manager - Authentication Bypass

    Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains a missing authentication for critical function vulnerability, letting unauthenticated remote attackers access sensitive information and bypass protections, exploit requires remote access.

  • 7.7 /10 High
    CVE-2026-78024 Auth required

    Dell Secure Connect Gateway - Server Side Request Forgery

    Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains a server side request forgery vulnerability caused by improper request validation, letting high privileged remote attackers perform SSRF and unauthorized access.

  • 7.1 /10 High
    CVE-2026-78023 Auth required

    Dell Secure Connect Gateway (SCG) Policy Manager - Authorization Bypass

    Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an authorization bypass through user-controlled key vulnerability, letting low privileged remote attackers elevate their privileges, exploit requires remote access.

  • 7.5 /10 High
    CVE-2026-78020 No auth

    Dell Secure Connect Gateway - Improper Certificate Validation

    Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an improper certificate validation vulnerability, letting unauthenticated remote attackers cause denial of service, information disclosure, and remote code execution.

  • 7.5 /10 High
    CVE-2026-78019 Auth required

    Dell Secure Connect Gateway Policy Manager - Privilege Escalation & Remote Code Execution

    Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an inclusion of functionality from untrusted control sphere vulnerability, letting low privileged remote attackers achieve privilege escalation, filesystem access, and remote code execution, exploit requires remote access with low privileges.