Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 201 of 695
- 8.5 /10 HighCVE-2026-8374
SwitchBot Door Lock Series - Authentication Bypass
SwitchBot Door Lock Series contains an authentication bypass caused by misuse and misconfiguration in Bluetooth communication, letting attackers bypass electronic lock and access controls via manipulated protocol, exploit requires proximity to the device.
- 7.2 /10 HighCVE-2026-81929 No auth
Ocean Pro Demos & Ocean eComm Treasure Box - Stored XSS
Ocean Pro Demos and Ocean eComm Treasure Box WordPress plugins <= 1.5.4 and 1.8.0 contain a stored cross-site scripting caused by insufficient authorization, input sanitization, and output escaping in Popup Builder's save_popup_content AJAX action, letting unauthenticated attackers inject scripts into published Gutenberg popups, exploit requires valid premium license, Popup Builder module, and published popup.
- 9.8 /10 CriticalCVE-2026-78835
Rocket Software Rocket Remote Desktop - Authentication Bypass
Rocket Software Rocket Remote Desktop 18.0.8583.1 contains an insufficiently protected credentials vulnerability caused by inadequate credential protection, letting attackers potentially access sensitive credentials, exploit requires attacker access to stored credentials.
- 9.8 /10 CriticalCVE-2026-78797 No auth
iStoreOS - Remote Code Execution
iStoreOS istoreos-24.10.7 and before contains a remote code execution caused by improper handling of task_id in tasks-lib.lua, letting remote attackers execute arbitrary code, exploit requires network access.
- 7.5 /10 HighCVE-2026-78795 No auth
Netcore B11 - Information Disclosure
Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router <= v1.3.241114.024540 contains an information disclosure vulnerability allowing remote attackers to obtain sensitive information without authentication.
- 8.1 /10 HighCVE-2026-7827 No auth
FalkorDB - Buffer Overflow
FalkorDB < 4.18.4 contains a stack-based buffer overflow caused by improper bounds checking in _RdbLoadEntity function of RDB graph decoders, letting remote attackers issuing Redis replication commands cause denial of service or remote code execution by supplying crafted RDB streams.
- 9.1 /10 CriticalCVE-2026-7826 No auth
FalkorDB - Out-of-Bounds Read
FalkorDB < 4.18.4 contains a heap-based out-of-bounds read caused by improper bounds checking in BufferSerializerIOv2_ReadBuffer function, letting remote attackers issuing Redis replication commands cause denial of service or memory disclosure, exploit requires ability to send replication commands.
- 7.5 /10 HighCVE-2026-78025 No auth
Dell Secure Connect Gateway Policy Manager - Authentication Bypass
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains a missing authentication for critical function vulnerability, letting unauthenticated remote attackers access sensitive information and bypass protections, exploit requires remote access.
- 7.7 /10 HighCVE-2026-78024 Auth required
Dell Secure Connect Gateway - Server Side Request Forgery
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains a server side request forgery vulnerability caused by improper request validation, letting high privileged remote attackers perform SSRF and unauthorized access.
- 7.1 /10 HighCVE-2026-78023 Auth required
Dell Secure Connect Gateway (SCG) Policy Manager - Authorization Bypass
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an authorization bypass through user-controlled key vulnerability, letting low privileged remote attackers elevate their privileges, exploit requires remote access.
- 7.5 /10 HighCVE-2026-78020 No auth
Dell Secure Connect Gateway - Improper Certificate Validation
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an improper certificate validation vulnerability, letting unauthenticated remote attackers cause denial of service, information disclosure, and remote code execution.
- 7.5 /10 HighCVE-2026-78019 Auth required
Dell Secure Connect Gateway Policy Manager - Privilege Escalation & Remote Code Execution
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an inclusion of functionality from untrusted control sphere vulnerability, letting low privileged remote attackers achieve privilege escalation, filesystem access, and remote code execution, exploit requires remote access with low privileges.
- 7.4 /10 HighCVE-2026-76779 No auth
Dell Secure Connect Gateway - Authentication Bypass
Dell Secure Connect Gateway (SCG) Policy Manager < 5.34.00.16 contains an improper restriction of excessive authentication attempts vulnerability, letting unauthenticated remote attackers elevate privileges and bypass protection mechanisms.
- 7.5 /10 HighCVE-2026-75352 No auth
OpENer - Denial of Service
OpENer v2.3 contains an integer underflow caused by a flaw in the server-side EtherNet/IP ForwardOpen connection-path parser, letting remote attackers cause denial of service, exploit requires network access.
- 7.5 /10 HighCVE-2026-75351 No auth
OpENer - Denial of Service
OpENer v2.3 contains an out-of-bounds read caused by a flaw in the server-side EtherNet/IP ForwardOpen connection-path parser, letting remote attackers cause denial of service, exploit requires network access.