Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 188 of 681
- 8.8 /10 HighCVE-2026-55797 Auth required
Argo CD - Command Injection
Argo CD 2.11.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contains a command injection caused by unneutralized shell metacharacters in SSH ProxyCommand during Git repository operations, letting users with repository creation/update privileges execute commands on repo-server.
- 8.1 /10 HighCVE-2026-39460
Affected Product - Information Disclosure
Affected product stores usernames and passwords, including default factory credentials, in plaintext within configuration files accessible via CLI or TFTP export through unauthenticated SNMP, letting attackers with admin or network access disclose sensitive credentials.
- 8.3 /10 HighCVE-2026-39453 Auth required
Switch - Denial of Service
Switch web server contains a denial of service vulnerability caused by navigating to a specific URL, letting remote attackers cause the device to reboot repeatedly, exploit requires no special privileges.
- 8.1 /10 HighCVE-2026-33367 Auth required
SNMP - Authentication Bypass
SNMP contains an authentication bypass vulnerability caused by lack of authentication for administrative actions, letting attackers perform configuration retrieval, user modification, and firmware upgrades without authentication.
- 7.1 /10 HighCVE-2026-29797 Auth required
N-Tron - Authentication Bypass
N-Tron devices contain an authentication bypass caused by lack of authentication in firmware and bootloader update processes via SNMP/TFTP, letting attackers push or pull firmware remotely without authentication.
- 7.5 /10 HighCVE-2026-28745
Generic Product - Weak Cryptography
A product contains a weak cryptography vulnerability caused by storing usernames and passwords, including default credentials, with weak encryption in the configuration file, letting attackers obtain other credentials if default credentials are known, exploit requires knowledge of default credentials.
- 8.2 /10 HighCVE-2026-22061 Auth required
Trident - Information Disclosure
Trident v25.02.1 through v26.06.1 contains an information disclosure vulnerability caused by improper protection of debug logs, letting authenticated attackers view LUKS passphrases or SMB Active Directory credentials, exploit requires authentication and access to debug logs.
- 7.8 /10 HighCVE-2026-19575 Auth required
Zephyr OS - Privilege Escalation
Zephyr OS v4.2.x and v4.3.x with CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT enabled contains a privilege escalation vulnerability caused by improper validation of the dev argument in device_deinit() syscall, letting local unprivileged threads execute arbitrary kernel code, exploit requires CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT enabled.
- 7.0 /10 HighCVE-2026-19574 Auth required
Linux ARM64 - Broken Access Control
The ARM64 Linux kernel contains a broken access control vulnerability in arch_mem_domain_init() due to ASID reuse after wraparound, letting user-mode threads bypass memory domain isolation and access other domains' memory, exploit requires creating more than 255 memory domains.
- 8.8 /10 HighCVE-2026-19570 No auth
Zephyr Bluetooth LE Audio Broadcast Sink - Buffer Overflow
Zephyr Bluetooth LE Audio Broadcast Sink contains a buffer overflow caused by lack of bounds checking when copying subgroup metadata from Basic Audio Announcement (BASE), letting remote attackers in radio range cause memory corruption and potential remote code execution, exploit requires attacker to be in radio range and send crafted BASE data.
- 8.8 /10 HighCVE-2026-19569
Zephyr Kernel - Buffer Overflow
Zephyr kernel with CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS contains a buffer overflow caused by unchecked unsigned integer wrap-around in dynamic_object_create() size calculations, letting unprivileged user-mode threads perform out-of-bounds writes to kernel heap, exploit requires CONFIG_USERSPACE, CONFIG_DYNAMIC_OBJECTS, and a thread with assigned resource pool.
- 9.8 /10 CriticalCVE-2026-15340 No auth
lwIP SMTP client - Buffer Overflow
lwIP SMTP client contains a buffer overflow caused by lack of input size validation, letting attackers potentially execute arbitrary code, exploit requires crafted input.
- 9.1 /10 CriticalCVE-2026-108269
Remote Attestation TLS Clients - Authentication Bypass
Remote Attestation TLS Clients < 0.5.0 contain a replay attack vulnerability caused by quote ReportData not being bound to the active TLS session in Rust and Go RA-TLS challenge verifiers, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108268
Enclave OS Virtual - Man-in-the-Middle
Enclave OS Virtual prior to tdx-v0.2.43 and tdx-gpu-v0.6.27 contains a man-in-the-middle vulnerability caused by omission of a value bound to the active TLS session in quote ReportData, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108267
Privasys Go - Authentication Bypass
Privasys Go prior to v0.5.1-go1.26.5 contains a replay attack vulnerability caused by challenge-mode RA-TLS certificates not binding the quote ReportData to the active TLS session, letting attackers relay genuine quotes to impersonate attested enclave connections, exploit requires attacker to obtain enclave TLS private key.