Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 214 of 695
- 7.5 /10 HighCVE-2026-78659 No auth
Go HTTP Server - Denial of Service
Go HTTP server contains a denial of service vulnerability caused by excessive 'Trailer' headers in HTTP/2 requests, letting remote attackers exhaust server memory, exploit requires HTTP/2 protocol support.
- 9.8 /10 CriticalCVE-2026-78406 No auth
IBM Security Verify Access & IBM Verify Identity Access - Remote Code Execution
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote unauthenticated attackers execute arbitrary code.
- 9.8 /10 CriticalCVE-2026-78401 No auth
IBM Security Verify Access & IBM Verify Identity Access - Remote Code Execution
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote unauthenticated attackers execute arbitrary code.
- 9.8 /10 CriticalCVE-2026-77900 No auth
Azure App Service - Authentication Bypass
Azure App Service contains a broken authentication caused by missing authentication for a critical function, letting unauthorized attackers execute code remotely, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-75875 No auth
IBM Guardium Data Protection - Remote Code Execution
IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a path traversal vulnerability that allows remote attackers to execute arbitrary code by accessing unintended file paths, exploit requires network access.
- 7.1 /10 HighCVE-2026-71895 Auth required
Apache DolphinScheduler - Authorization Bypass
Apache DolphinScheduler 3.2.0 to before 3.4.3 contains an authorization vulnerability caused by improper access control to Kubernetes configuration data, letting authenticated non-admin users retrieve sensitive kubeconfig credentials, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-71183 Auth required
Apache DolphinScheduler - Broken Access Control
Apache DolphinScheduler < 3.4.3 contains an authorization vulnerability caused by missing access control enforcement in /unauth-datasource and /authed-datasource endpoints, letting authenticated users access unauthorized sensitive data source information, exploit requires user authentication.
- 9.6 /10 CriticalCVE-2026-69435 Auth required
Azure SRE Agent - Broken Access Control
Azure SRE Agent contains a broken access control vulnerability caused by missing authorization checks, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 7.5 /10 HighCVE-2026-67693
GnuTLS - Information Disclosure
GnuTLS 3.8.13 contains an information disclosure vulnerability caused by failure to reject end-entity X.509 certificates with contradictory Key Usage and Extended Key Usage, letting attackers obtain sensitive information, exploit requires crafted certificates.
- 7.1 /10 HighCVE-2026-66479 No auth
Liquid Web / StellarWP WPComplete - Stored XSS
Liquid Web / StellarWP WPComplete <= 2.9.5.6 contains a stored XSS caused by insufficient input sanitization, letting attackers execute scripts via stored payloads, exploit requires victim interaction.
- 8.1 /10 HighCVE-2026-66087 Auth required
Apache DolphinScheduler - Authorization Bypass
Apache DolphinScheduler before 3.4.3 contains an authorization bypass caused by insufficient access control in task instance operations, letting authenticated users operate task instances in unauthorized projects, exploit requires user authentication.
- 8.1 /10 HighCVE-2026-66084 Auth required
Apache DolphinScheduler - Authorization Bypass
Apache DolphinScheduler < 3.4.3 contains an authorization bypass caused by improper verification of task definition ownership in the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint, letting authenticated users modify task definitions in unauthorized projects, exploit requires user authentication.
- 8.8 /10 HighCVE-2026-62142 No auth
Melapress WP 2FA - Cross Site Request Forgery
Melapress WP 2FA wp-2fa <= 4.1.0 contains a cross site request forgery vulnerability caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.
- 7.5 /10 HighCVE-2026-56866 No auth
Go http.Transport - HTTP Request Smuggling
Go http.Transport contains a cross-user response poisoning vulnerability caused by improper handling of HTTP/1 CONNECT requests with non-empty bodies, letting attackers cause connection desynchronization and response injection, exploit requires use of shared Transport in reverse proxies.
- 9.8 /10 CriticalCVE-2026-56857 No auth
Windows - Path Traversal
Windows file system operations Root.Mkdir and Root.MkdirAll contain a path traversal vulnerability caused by improper handling of junction points, letting attackers create directories outside the root, exploit requires a junction pointing to an empty location.