Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 203 of 695
- 8.1 /10 HighCVE-2026-33367 Auth required
SNMP - Authentication Bypass
SNMP contains an authentication bypass vulnerability caused by lack of authentication for administrative actions, letting attackers perform configuration retrieval, user modification, and firmware upgrades without authentication.
- 7.1 /10 HighCVE-2026-29797 Auth required
N-Tron - Authentication Bypass
N-Tron devices contain an authentication bypass caused by lack of authentication in firmware and bootloader update processes via SNMP/TFTP, letting attackers push or pull firmware remotely without authentication.
- 7.5 /10 HighCVE-2026-28745
Generic Product - Weak Cryptography
A product contains a weak cryptography vulnerability caused by storing usernames and passwords, including default credentials, with weak encryption in the configuration file, letting attackers obtain other credentials if default credentials are known, exploit requires knowledge of default credentials.
- 8.2 /10 HighCVE-2026-22061 Auth required
Trident - Information Disclosure
Trident v25.02.1 through v26.06.1 contains an information disclosure vulnerability caused by improper protection of debug logs, letting authenticated attackers view LUKS passphrases or SMB Active Directory credentials, exploit requires authentication and access to debug logs.
- 7.8 /10 HighCVE-2026-19575 Auth required
Zephyr OS - Privilege Escalation
Zephyr OS v4.2.x and v4.3.x with CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT enabled contains a privilege escalation vulnerability caused by improper validation of the dev argument in device_deinit() syscall, letting local unprivileged threads execute arbitrary kernel code, exploit requires CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT enabled.
- 7.0 /10 HighCVE-2026-19574 Auth required
Linux ARM64 - Broken Access Control
The ARM64 Linux kernel contains a broken access control vulnerability in arch_mem_domain_init() due to ASID reuse after wraparound, letting user-mode threads bypass memory domain isolation and access other domains' memory, exploit requires creating more than 255 memory domains.
- 8.8 /10 HighCVE-2026-19570 No auth
Zephyr Bluetooth LE Audio Broadcast Sink - Buffer Overflow
Zephyr Bluetooth LE Audio Broadcast Sink contains a buffer overflow caused by lack of bounds checking when copying subgroup metadata from Basic Audio Announcement (BASE), letting remote attackers in radio range cause memory corruption and potential remote code execution, exploit requires attacker to be in radio range and send crafted BASE data.
- 8.8 /10 HighCVE-2026-19569
Zephyr Kernel - Buffer Overflow
Zephyr kernel with CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS contains a buffer overflow caused by unchecked unsigned integer wrap-around in dynamic_object_create() size calculations, letting unprivileged user-mode threads perform out-of-bounds writes to kernel heap, exploit requires CONFIG_USERSPACE, CONFIG_DYNAMIC_OBJECTS, and a thread with assigned resource pool.
- 9.8 /10 CriticalCVE-2026-15340 No auth
lwIP SMTP client - Buffer Overflow
lwIP SMTP client contains a buffer overflow caused by lack of input size validation, letting attackers potentially execute arbitrary code, exploit requires crafted input.
- 9.1 /10 CriticalCVE-2026-108269
Remote Attestation TLS Clients - Authentication Bypass
Remote Attestation TLS Clients < 0.5.0 contain a replay attack vulnerability caused by quote ReportData not being bound to the active TLS session in Rust and Go RA-TLS challenge verifiers, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108268
Enclave OS Virtual - Man-in-the-Middle
Enclave OS Virtual prior to tdx-v0.2.43 and tdx-gpu-v0.6.27 contains a man-in-the-middle vulnerability caused by omission of a value bound to the active TLS session in quote ReportData, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108267
Privasys Go - Authentication Bypass
Privasys Go prior to v0.5.1-go1.26.5 contains a replay attack vulnerability caused by challenge-mode RA-TLS certificates not binding the quote ReportData to the active TLS session, letting attackers relay genuine quotes to impersonate attested enclave connections, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108266
Privasys rustls - Man-in-the-Middle
Privasys rustls before v0.8.1 contains a replay attack vulnerability caused by RA-TLS challenge certificates binding quote ReportData to public key and client nonce but not active TLS session, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108265
Enclave OS Mini - Authentication Bypass
Enclave OS Mini prior to wasm-v0.40.0 contains a replay attack vulnerability caused by omission of a value bound to the active TLS session in RA-TLS challenge certificate path, letting attackers relay genuine quotes to impersonate enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108264 Auth required
Wizarr - Remote Code Execution & Stored XSS
Wizarr prior to 2026.9.1 contains a remote code execution caused by unsafe evaluation of Markdown in a non-sandboxed Jinja2 environment, letting authenticated users or admins execute arbitrary Python and OS commands, exploit requires authenticated user or admin importing untrusted bundles.