Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 20 of 891

  • 7.3 /10 High
    CVE-2026-91912 Auth required

    Dell OpenManage Enterprise - Hardcoded Credentials

    Dell OpenManage Enterprise < 4.8.0 contains a hardcoded cryptographic key vulnerability caused by use of hard-coded keys, letting low privileged local attackers disclose sensitive information, exploit requires local access.

  • 9.8 /10 Critical
    CVE-2026-90888 No auth

    LeadSnap - Insecure Deserialization

    LeadSnap <= 1.25 contains an unauthenticated PHP Object Injection caused by improper handling of serialized objects, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-90437 No auth

    Gravity Forms - Stored XSS

    Gravity Forms WordPress plugin <= 3.1.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Post Excerpt, Post Custom Field, and Rich-Text Paragraph fields, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.

  • 8.8 /10 High
    CVE-2026-89435 Auth required

    Formidable Forms WordPress Plugin - Unrestricted File Upload

    Formidable Forms WordPress plugin <= 6.35 contains an arbitrary plugin installation vulnerability caused by insufficient URL prefix validation and weak permission checks, letting authenticated attackers with subscriber-level access install plugins, exploit requires free-only site without Formidable Pro.

  • 7.1 /10 High
    CVE-2026-86715

    Crypttech Vatos DLP - Authentication Bypass

    Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP 1.1.176 < 1.1.243 contains a plaintext password storage vulnerability caused by insecure credential storage, letting attackers use known domain credentials, exploit requires access to stored credentials.

  • 8.7 /10 High
    CVE-2026-85268 No auth

    Google Cloud Identity Platform & Firebase Authentication - Stored XSS

    Google Cloud Identity Platform and Firebase Authentication < 2026-08-14 on iOS contain a stored XSS caused by improper sanitization of iOS bundle ID in auth/handler, letting unauthenticated remote attackers execute arbitrary JavaScript.

  • 7.0 /10 High
    CVE-2026-84243

    GNU C Library - Command Injection

    GNU C Library >= 2.0 contains a command injection caused by unsafe handling of LANGUAGE environment variable in gettext functions, letting attackers load crafted message catalogs to execute arbitrary code, exploit requires attacker to set LANGUAGE and select a non-C locale.

  • 9.4 /10 Critical
    CVE-2026-82104 No auth

    Teltonika Networks RUTOS - Command Injection

    Teltonika Networks RUTOS 7.22 through 7.24.2 and TSWOS 1.9 through 1.10 contain a command injection caused by unauthenticated direct calls to LUA functions bypassing validation, letting attackers execute OS commands remotely, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-78527 Auth required

    GS Testimonial Slider - PHP Object Injection

    GS Testimonial Slider <= 3.3.10 contains a PHP Object Injection caused by unsafe unserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-78403 No auth

    Thales Sentinel Keys Server - Buffer Overflow & Broken Access Control

    Thales Sentinel Keys Server < 1.3.8.0 contains a stack-based buffer overflow and missing authorization vulnerability caused by unchecked length of the first field in HTTP requests, letting remote attackers execute code as NT AUTHORITY\SYSTEM, exploit requires crafted HTTP request.

  • 7.8 /10 High
    CVE-2026-78402 Auth required

    Thales Sentinel Keys Server - Buffer Overflow

    Thales Sentinel Keys Server < 1.3.8.0 contains a stack-based buffer overflow and out-of-bounds write caused by unchecked length of the first field in input messages, letting local attackers execute code as NT AUTHORITY\SYSTEM, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-76031 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.79 contains a use after free caused by improper memory handling in input processing, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-76030 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.79 contains a memory corruption vulnerability in FileSystem, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires crafted HTML content.

  • 8.8 /10 High
    CVE-2026-76029 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.79 contains a memory corruption vulnerability in Network, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-76028 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.79 contains a use after free caused by improper memory handling in FileSystem, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.