Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 210 of 695

  • 9.1 /10 Critical
    CVE-2026-88647

    GnuTLS - Authentication Bypass

    GnuTLS 3.8.13 contains a hostname verification bypass caused by improper Common Name fallback mechanism handling, letting attackers eavesdrop on communications via crafted certificates, exploit requires crafted certificate.

  • 9.8 /10 Critical
    CVE-2026-88131 No auth

    Microsoft Dataverse - Insecure Deserialization

    Microsoft Dataverse contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 7.3 /10 High
    CVE-2026-87687 Auth required

    Brocade Fabric OS - Broken Access Control

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an authorization and input validation vulnerability caused by improper validation of fabric identifiers, letting authenticated restricted users perform unauthorized cross-fabric operations and view configuration details, exploit requires authenticated user with restricted privileges.

  • 9.8 /10 Critical
    CVE-2026-87684 No auth

    Brocade Fabric - Buffer Overflow

    Brocade Fabric < 10.0.1 contains a stack-based buffer overflow caused by improper length validation of user-supplied context name in SNMP daemon request handling, letting remote unauthenticated attackers cause memory corruption, DoS, or code execution.

  • 8.8 /10 High
    CVE-2026-87683 Auth required

    Brocade Fabric OS - Buffer Overflow

    Brocade Fabric OS < 10.0.1 contains stack-based buffer overflow vulnerabilities caused by improper validation of array counts and string lengths in REST API management component, letting authenticated attackers cause denial-of-service or execute arbitrary code, exploit requires REST API access.

  • 8.8 /10 High
    CVE-2026-87682 Auth required

    Brocade Fabric OS - Command Injection

    Brocade Fabric OS < 10.0.1 contains command injection vulnerabilities caused by improper input processing in management interface and session routines, letting authenticated users or compromised directory accounts execute OS commands with elevated privileges.

  • 8.8 /10 High
    CVE-2026-87680 Auth required

    Brocade Fabric OS - Command Injection

    Brocade Fabric OS < 10.0.1 contains a command injection caused by improper input validation in the REST API management interface, letting authenticated users execute arbitrary system commands.

  • 7.2 /10 High
    CVE-2026-87679 Auth required

    Brocade Fabric OS - Buffer Overflow

    Brocade Fabric OS < 10.0.1 contains a buffer overflow caused by lack of boundary checks on user-supplied list strings in trunk configuration operations, letting authenticated administrators cause heap corruption leading to service crash or code execution.

  • 7.8 /10 High
    CVE-2026-87674 Auth required

    Brocade Fabric OS - Privilege Escalation

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contains a local privilege escalation caused by insufficient access controls and improper input sanitization in the system logging daemon's IPC channels, letting unprivileged local users execute arbitrary directives with elevated privileges, exploit requires local access.

  • 7.2 /10 High
    CVE-2026-87673 Auth required

    Brocade Fabric OS - Command Injection

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an OS command injection caused by unsanitized input in maintenance command-line diagnostic utilities, letting privileged maintenance users execute arbitrary OS commands as root.

  • 7.5 /10 High
    CVE-2026-87671 No auth

    Brocade Fabric OS - Denial of Service

    Brocade Fabric OS < 10.0.1 contains an out-of-bounds read caused by improper validation of URL query parameters in the web management daemon, letting unauthenticated remote attackers cause denial of service via crafted HTTP requests.

  • 8.0 /10 High
    CVE-2026-87666 Auth required

    Brocade Fabric OS - OS Command Injection

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an OS command injection caused by improper input sanitization in timezone management subsystem, letting authenticated low-privilege admin users execute arbitrary shell commands with elevated privileges.

  • 7.5 /10 High
    CVE-2026-87665 No auth

    Brocade Fabric OS - Denial of Service

    Brocade Fabric OS < 10.0.1 contains a stack-based buffer overflow caused by processing oversized Nonce payloads in IKEv2 protocol handler on IPsec-enabled FCIP circuits, letting unauthenticated remote attackers cause denial of service via crafted UDP packets on port 500.

  • 7.8 /10 High
    CVE-2026-87664 Auth required

    Brocade Fabric OS - Broken Access Control

    Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 contain a broken access control vulnerability caused by improper verification of IPC storage callbacks in the web management daemon, letting attackers gain administrative privileges without authentication.

  • 7.1 /10 High
    CVE-2026-87660 Auth required

    Brocade Fabric OS - Broken Access Control

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an improper file permission and missing authorization vulnerability in the diagnostic kernel module subsystem, letting unprivileged local users disrupt storage fabric operations and invoke privileged hardware tests, exploit requires local unprivileged user access.