Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 195 of 681

  • 9.8 /10 Critical
    CVE-2026-9209 No auth

    mJobTime - SQL Injection & Remote Code Execution

    mJobTime through 15.7.3.32 contains an unauthenticated SQL injection caused by execution of caller-supplied SQL in Login.aspx admin panel handlers, letting attackers achieve pre-authentication remote code execution as LocalSystem via HTTP request.

  • 7.3 /10 High
    CVE-2026-91844 Auth required

    İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip - Unrestricted File Upload

    İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip v1.6.4 to before v1.6.6 contains an unrestricted file upload vulnerability caused by lack of file type restrictions, letting attackers upload malicious files remotely, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-89091 No auth

    ansible-core - Path Traversal & Remote Code Execution

    ansible-core contains a path traversal caused by improper symlink resolution in ansible-galaxy collection install archive extraction, letting attackers overwrite arbitrary files and execute code on the control node, exploit requires victim to install a malicious collection.

  • 9.1 /10 Critical
    CVE-2026-88647

    GnuTLS - Authentication Bypass

    GnuTLS 3.8.13 contains a hostname verification bypass caused by improper Common Name fallback mechanism handling, letting attackers eavesdrop on communications via crafted certificates, exploit requires crafted certificate.

  • 9.8 /10 Critical
    CVE-2026-88131 No auth

    Microsoft Dataverse - Insecure Deserialization

    Microsoft Dataverse contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 7.3 /10 High
    CVE-2026-87687 Auth required

    Brocade Fabric OS - Broken Access Control

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an authorization and input validation vulnerability caused by improper validation of fabric identifiers, letting authenticated restricted users perform unauthorized cross-fabric operations and view configuration details, exploit requires authenticated user with restricted privileges.

  • 9.8 /10 Critical
    CVE-2026-87684 No auth

    Brocade Fabric - Buffer Overflow

    Brocade Fabric < 10.0.1 contains a stack-based buffer overflow caused by improper length validation of user-supplied context name in SNMP daemon request handling, letting remote unauthenticated attackers cause memory corruption, DoS, or code execution.

  • 8.8 /10 High
    CVE-2026-87683 Auth required

    Brocade Fabric OS - Buffer Overflow

    Brocade Fabric OS < 10.0.1 contains stack-based buffer overflow vulnerabilities caused by improper validation of array counts and string lengths in REST API management component, letting authenticated attackers cause denial-of-service or execute arbitrary code, exploit requires REST API access.

  • 8.8 /10 High
    CVE-2026-87682 Auth required

    Brocade Fabric OS - Command Injection

    Brocade Fabric OS < 10.0.1 contains command injection vulnerabilities caused by improper input processing in management interface and session routines, letting authenticated users or compromised directory accounts execute OS commands with elevated privileges.

  • 8.8 /10 High
    CVE-2026-87680 Auth required

    Brocade Fabric OS - Command Injection

    Brocade Fabric OS < 10.0.1 contains a command injection caused by improper input validation in the REST API management interface, letting authenticated users execute arbitrary system commands.

  • 7.2 /10 High
    CVE-2026-87679 Auth required

    Brocade Fabric OS - Buffer Overflow

    Brocade Fabric OS < 10.0.1 contains a buffer overflow caused by lack of boundary checks on user-supplied list strings in trunk configuration operations, letting authenticated administrators cause heap corruption leading to service crash or code execution.

  • 7.8 /10 High
    CVE-2026-87674 Auth required

    Brocade Fabric OS - Privilege Escalation

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contains a local privilege escalation caused by insufficient access controls and improper input sanitization in the system logging daemon's IPC channels, letting unprivileged local users execute arbitrary directives with elevated privileges, exploit requires local access.

  • 7.2 /10 High
    CVE-2026-87673 Auth required

    Brocade Fabric OS - Command Injection

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an OS command injection caused by unsanitized input in maintenance command-line diagnostic utilities, letting privileged maintenance users execute arbitrary OS commands as root.

  • 7.5 /10 High
    CVE-2026-87671 No auth

    Brocade Fabric OS - Denial of Service

    Brocade Fabric OS < 10.0.1 contains an out-of-bounds read caused by improper validation of URL query parameters in the web management daemon, letting unauthenticated remote attackers cause denial of service via crafted HTTP requests.

  • 8.0 /10 High
    CVE-2026-87666 Auth required

    Brocade Fabric OS - OS Command Injection

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an OS command injection caused by improper input sanitization in timezone management subsystem, letting authenticated low-privilege admin users execute arbitrary shell commands with elevated privileges.