Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 193 of 681

  • 7.2 /10 High
    CVE-2026-104082 PoC publicAuth required

    SmarterMail - Remote Code Execution

    SmarterMail before build 9777 contains a remote code execution caused by bypassing Volume Mount script-directory containment via domain-put endpoint, letting attackers with SysAdmin-scoped tokens execute SYSTEM-level code, exploit requires SysAdmin-scoped access token.

  • 8.1 /10 High
    CVE-2026-104081 Auth required

    KodExplorer - Path Traversal & Stored XSS

    KodExplorer < 4.55 contains a path traversal vulnerability caused by insufficient sanitization in unzip_pre_name() and lack of directory restriction in PclZip extract(), letting authenticated attackers overwrite files and execute remote code via crafted ZIP uploads.

  • 8.8 /10 High
    CVE-2026-103413 Auth required

    Apache Camel Karavan - Broken Access Control

    Apache Camel Karavan 4.0.0 to <4.22.1 contains an improper input validation vulnerability caused by unrestricted application of Kubernetes resources from unmarshalled kubernetes.yaml, letting authenticated users of any role apply arbitrary Kubernetes resources with elevated privileges, exploit requires user authentication.

  • 8.8 /10 High
    CVE-2026-103412 Auth required

    Apache Camel Karavan - Path Traversal

    Apache Camel Karavan >= 3.18.0 < 4.22.1 contains a path traversal caused by improper limitation of project file names in the project file API, letting authenticated users overwrite files and execute code, exploit requires authentication.

  • 8.2 /10 High
    CVE-2026-102554 No auth

    Google Guava - Denial of Service

    Google Guava 4.0 through 33.7.1 contains a denial of service caused by unthrottled resource allocation during deserialization of CompactHashMap, CompactHashSet, or MapMakerInternalMap, letting attackers cause memory exhaustion via crafted streams, exploit requires crafted serialization input.

  • 9.8 /10 Critical
    CVE-2026-100730

    openPDC & openHistorian - Insecure Deserialization

    openPDC and openHistorian contain an insecure deserialization vulnerability caused by deserializing client-supplied data structures in the service console interface, letting attackers execute remote code under service account privileges, exploit requires authentication on Windows Authentication systems or none otherwise.

  • 8.8 /10 High
    CVE-2025-15700 Auth required

    AWP Classifieds WordPress plugin - Unrestricted File Upload

    AWP Classifieds WordPress plugin < 4.4.9 contains an unrestricted file upload vulnerability caused by improper validation of files extracted from uploaded ZIP archives during listing-import, letting users with management capability upload arbitrary PHP files and achieve remote code execution.

  • 7.2 /10 High
    CVE-2026-97147 Auth required

    OpenStack Mistral - Broken Access Control

    OpenStack Mistral through 23.0.0 contains a broken access control vulnerability caused by improper resource resolution in v2 API write paths, letting authenticated project members modify other projects' resources, exploit requires authentication and API exposure.

  • 7.5 /10 High
    CVE-2026-97031 No auth

    Server Process - Denial of Service

    A server process contains a memory exhaustion vulnerability caused by allowing multiple ECH outer extension references, letting remote attackers cause denial of service, exploit requires sending crafted packets.

  • 10.0 /10 Critical
    CVE-2026-96207 No auth

    Microsoft Partner Center - Authentication Bypass

    Microsoft Partner Center contains a broken authentication caused by improper certificate validation, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-95210

    GnuTLS - Weak Cryptography

    GnuTLS 3.8.13 contains an insecure certificate validation caused by acceptance of certificates with invalid extensions, letting attackers bypass certificate validation, exploit requires attacker to present crafted certificates.

  • 7.5 /10 High
    CVE-2026-95209 No auth

    gnutls - Denial of Service

    gnutls v3.8.13 contains a denial of service caused by rejection of legitimate CA certificates, letting attackers cause service disruption, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-95208

    wolfSSL - Denial of Service

    wolfSSL v5.9.1 and v5.9.2 contain a denial of service caused by improper handling in ConfirmNameConstraints() function when processing crafted Certificate Authority certificates, letting attackers cause valid certificates without SAN to be rejected, exploit requires crafted CA certificates.

  • 7.5 /10 High
    CVE-2026-95184 No auth

    GnuTLS - Denial of Service

    GnuTLS v3.8.13 contains improper certificate validation causing rejection of legitimate certificates, letting attackers cause denial of service by blocking valid users, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-95116 No auth

    libming - Denial of Service

    libming <= 0.4.8 contains a denial of service caused by improper handling in readtag_file() in src/blocks/fromswf.c, letting remote attackers cause application crash, exploit requires crafted SWF file.