Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 208 of 695

  • 8.8 /10 High
    CVE-2026-103412 Auth required

    Apache Camel Karavan - Path Traversal

    Apache Camel Karavan >= 3.18.0 < 4.22.1 contains a path traversal caused by improper limitation of project file names in the project file API, letting authenticated users overwrite files and execute code, exploit requires authentication.

  • 8.2 /10 High
    CVE-2026-102554 No auth

    Google Guava - Denial of Service

    Google Guava 4.0 through 33.7.1 contains a denial of service caused by unthrottled resource allocation during deserialization of CompactHashMap, CompactHashSet, or MapMakerInternalMap, letting attackers cause memory exhaustion via crafted streams, exploit requires crafted serialization input.

  • 9.8 /10 Critical
    CVE-2026-100730

    openPDC & openHistorian - Insecure Deserialization

    openPDC and openHistorian contain an insecure deserialization vulnerability caused by deserializing client-supplied data structures in the service console interface, letting attackers execute remote code under service account privileges, exploit requires authentication on Windows Authentication systems or none otherwise.

  • 8.8 /10 High
    CVE-2025-15700 Auth required

    AWP Classifieds WordPress plugin - Unrestricted File Upload

    AWP Classifieds WordPress plugin < 4.4.9 contains an unrestricted file upload vulnerability caused by improper validation of files extracted from uploaded ZIP archives during listing-import, letting users with management capability upload arbitrary PHP files and achieve remote code execution.

  • 7.2 /10 High
    CVE-2026-97147 Auth required

    OpenStack Mistral - Broken Access Control

    OpenStack Mistral through 23.0.0 contains a broken access control vulnerability caused by improper resource resolution in v2 API write paths, letting authenticated project members modify other projects' resources, exploit requires authentication and API exposure.

  • 7.5 /10 High
    CVE-2026-97031 No auth

    Server Process - Denial of Service

    A server process contains a memory exhaustion vulnerability caused by allowing multiple ECH outer extension references, letting remote attackers cause denial of service, exploit requires sending crafted packets.

  • 10.0 /10 Critical
    CVE-2026-96207 No auth

    Microsoft Partner Center - Authentication Bypass

    Microsoft Partner Center contains a broken authentication caused by improper certificate validation, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-95210

    GnuTLS - Weak Cryptography

    GnuTLS 3.8.13 contains an insecure certificate validation caused by acceptance of certificates with invalid extensions, letting attackers bypass certificate validation, exploit requires attacker to present crafted certificates.

  • 7.5 /10 High
    CVE-2026-95209 No auth

    gnutls - Denial of Service

    gnutls v3.8.13 contains a denial of service caused by rejection of legitimate CA certificates, letting attackers cause service disruption, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-95208

    wolfSSL - Denial of Service

    wolfSSL v5.9.1 and v5.9.2 contain a denial of service caused by improper handling in ConfirmNameConstraints() function when processing crafted Certificate Authority certificates, letting attackers cause valid certificates without SAN to be rejected, exploit requires crafted CA certificates.

  • 7.5 /10 High
    CVE-2026-95184 No auth

    GnuTLS - Denial of Service

    GnuTLS v3.8.13 contains improper certificate validation causing rejection of legitimate certificates, letting attackers cause denial of service by blocking valid users, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-95116 No auth

    libming - Denial of Service

    libming <= 0.4.8 contains a denial of service caused by improper handling in readtag_file() in src/blocks/fromswf.c, letting remote attackers cause application crash, exploit requires crafted SWF file.

  • 8.8 /10 High
    CVE-2026-94585 No auth

    Brocade Fabric OS - Authentication Bypass

    Brocade Fabric OS < 9.2.2d on MXG610 contains an authentication bypass caused by an unauthenticated endpoint in the Single Sign-On workflow, letting unauthenticated network-adjacent attackers gain administrative access.

  • 7.8 /10 High
    CVE-2026-94582

    Brocade Fabric OS - Buffer Overflow

    Brocade Fabric OS < 10.0.1 contains a buffer overflow caused by improper bounds checking in internal diagnostic and route validation routines of the FSPF protocol, letting attackers cause daemon crash or execute code, exploit requires chaining other vulnerabilities.

  • 8.0 /10 High
    CVE-2026-94579 Auth required

    Brocade Fabric OS - Command Injection

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an OS command injection caused by improper handling of shell metacharacters in usernames or profile identifiers during SSH session termination, letting authenticated users execute arbitrary commands with root privileges, exploit requires authentication via external directory or AAA service.