Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 187 of 681

  • 7.4 /10 High
    CVE-2026-76779 No auth

    Dell Secure Connect Gateway - Authentication Bypass

    Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an improper restriction of excessive authentication attempts vulnerability, letting unauthenticated remote attackers elevate privileges and bypass protection mechanisms.

  • 7.5 /10 High
    CVE-2026-75352 No auth

    OpENer - Denial of Service

    OpENer v2.3 contains an integer underflow caused by a flaw in the server-side EtherNet/IP ForwardOpen connection-path parser, letting remote attackers cause denial of service, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-75351 No auth

    OpENer - Denial of Service

    OpENer v2.3 contains an out-of-bounds read caused by a flaw in the server-side EtherNet/IP ForwardOpen connection-path parser, letting remote attackers cause denial of service, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-75350 No auth

    EIPStackGroup OpENer - Buffer Overflow

    EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow caused by improper handling in GetAttributeList() for EtherNet/IP Get_Attribute_List service, letting remote attackers cause denial of service, exploit requires crafted network request.

  • 7.5 /10 High
    CVE-2026-75349 No auth

    EIPStackGroup OpENer - Denial of Service

    EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains a denial of service caused by out-of-bounds read in Connection Manager request parsing, letting remote attackers cause service disruption, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-75348 No auth

    EIPStackGroup OpENer - Denial of Service

    EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an out-of-bounds read caused by improper validation in the EtherNet/IP TCP SendRRData Common Packet Format parser, letting remote attackers cause denial of service, exploit requires crafted packets.

  • 7.5 /10 High
    CVE-2026-75347 No auth

    EIPStackGroup OpENer - Denial of Service

    EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain a denial of service caused by expired pointer dereference in EtherNet/IP Common Packet Format handling logic, letting remote attackers cause service disruption, exploit requires crafted packets.

  • 7.5 /10 High
    CVE-2026-75346 No auth

    EIPStackGroup OpENer - Out of Bounds Read

    EIPStackGroup OpENer v2.3 and master through commit 76b95cf contain an out-of-bounds read vulnerability in the server-side CIP SetAttributeList service, letting remote attackers cause denial of service, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-75345 No auth

    OpENer - Denial of Service

    OpENer v2.3.0 contains an out-of-bounds read in the unconnected explicit messaging path, letting remote attackers cause denial of service, exploit requires crafted network messages.

  • 8.2 /10 High
    CVE-2026-71884 No auth

    Bouncy Castle - Cryptographic Vulnerability

    Bouncy Castle for Java LTS before 2.73.13 contains a cryptographic vulnerability caused by lack of counter range validation in native one-shot CTR packet cipher, letting attackers recover plaintext from ciphertext due to keystream reuse, exploit requires crafted input with specific IV length.

  • 8.1 /10 High
    CVE-2026-62376

    Vikunja - Authentication Bypass

    Vikunja < 2.4.0 contains an information disclosure vulnerability caused by storing password-reset, email-confirmation, and account-deletion tokens in plaintext in the user_tokens table, letting attackers with read access to the database take over user accounts, exploit requires database read access.

  • 7.5 /10 High
    CVE-2026-62367

    Vikunja - Authentication Bypass

    Vikunja 1.0.0 through 2.3.0 contains an authentication bypass caused by linking SSO login to local accounts using unverified email claims in OpenID Connect provider, letting attackers log in as victims without consent, exploit requires attacker to obtain a valid token with victim's email.

  • 7.1 /10 High
    CVE-2026-62026 No auth

    MIGHTYminnow Dashboard Notes - Cross Site Request Forgery

    MIGHTYminnow Dashboard Notes <= 1.0.3 contains a cross site request forgery vulnerability caused by lack of CSRF protection, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 9.8 /10 Critical
    CVE-2026-5759 No auth

    FalkorDB - Use After Free

    FalkorDB < 4.18.1 contains a double free and use-after-free vulnerability caused by improper length check in RdbLoadDeletedNodes function of RDB graph decoders, letting remote attackers issuing Redis replication commands cause denial of service or remote code execution, exploit requires ability to issue replication commands.

  • 8.1 /10 High
    CVE-2026-57458 Auth required

    Vikunja - Broken Access Control

    Vikunja 2.3.0 contains a broken access control vulnerability caused by scoped API tokens allowing OAuth authorization code exchange to obtain unrestricted bearer tokens, letting attackers access routes beyond original token scope, exploit requires scoped API token with oauth.authorize permission.