Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 222 of 695
- 8.8 /10 HighCVE-2026-106433 Auth required
MongoDB libmongocrypt - Out of Bounds Read/Write
MongoDB libmongocrypt contains an out-of-bounds memory access caused by improper state management when cleaning up key documents with duplicate masterKey fields, letting authenticated actors cause application termination or memory corruption, exploit requires ability to modify key vault documents.
- 9.9 /10 CriticalCVE-2026-106126 Auth required
Tenable Identity Exposure - Command Injection
Tenable Identity Exposure (SaaS) contains a command injection caused by improper input handling in Active Directory Events Listener, letting authenticated low-privileged attackers execute arbitrary commands as SYSTEM on the PDCe, exploit requires authentication.
- 7.7 /10 HighCVE-2026-105833 Auth required
EspoCRM - Broken Access Control
EspoCRM < 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service, letting users with Email Account scope retrieve other users' IMAP passwords, exploit requires knowledge of victim's Email Account record ID.
- 7.5 /10 HighCVE-2026-105830 No auth
league/commonmark - Denial of Service
league/commonmark > 2.0.0 < 2.10.2 contains a denial of service caused by quadratic-time complexity in TableStartParser::tryStart() block-start scan in GitHub Flavored Markdown Table extension, letting unauthenticated attackers exhaust CPU by submitting large pipe-free paragraphs.
- 8.7 /10 HighCVE-2026-105674 No auth
TP-Link Tapo - Authentication Bypass
TP-Link Tapo C325WB V2 contains a predictable pre-shared key generation caused by a time-seeded pseudo-random number generator in the local media streaming service, letting unauthenticated adjacent-network attackers recover the key and authenticate without valid credentials.
- 7.1 /10 HighCVE-2026-105673 No auth
Tapo C325WB - Denial of Service
Tapo C325WB v2 contains a denial-of-service vulnerability caused by crafted RTSP-over-HTTP tunneling requests in the RTSP streaming service on TCP port 554 when Camera Account feature is enabled, letting unauthenticated adjacent-network attackers disrupt live video streaming, exploit requires Camera Account feature enabled.
- 8.7 /10 HighCVE-2026-105672
TP-Link Tapo - Authorization Bypass
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass caused by manipulation of onboarding-scoped objects in the HTTPS JSON API dispatcher on TCP port 443, letting adjacent-network attackers invoke privileged actions without authentication.
- 8.8 /10 HighCVE-2026-105436 No auth
MainWP MainWP Child - Insecure Deserialization
MainWP MainWP Child <= 6.2.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-105110 No auth
Iskratel Innbox GPON ONT - Command Injection
Iskratel Innbox GPON ONT contains a command injection caused by improper sanitization of the CLI parameter in the login.xgi CGI endpoint, letting unauthenticated remote attackers execute arbitrary commands as root.
- 7.6 /10 HighCVE-2026-105076 Auth required
Appsbd Vitepos - SQL Injection
Appsbd Vitepos vitepos-lite <= 3.6.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 7.4 /10 HighCVE-2026-104704
Progressive Robot hMailServer - Man-in-the-Middle
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a misconfiguration in TLS enforcement for outbound SMTP delivery caused by improper handling of DNSSEC-validated TLSA records, letting network attackers suppress STARTTLS and read or modify messages in cleartext, exploit requires active network position.
- 7.8 /10 HighCVE-2026-104660 Auth required
Progressive Robot hMailServer - Broken Access Control
Progressive Robot hMailServer 6.0.0 through 6.3.5 on Windows contains a broken access control vulnerability caused by missing authorization on COM objects, letting local users read/write arbitrary files and send mail as any sender without credentials, exploit requires local interactive access.
- 7.5 /10 HighCVE-2026-104659 No auth
Progressive Robot hMailServer - Authentication Bypass
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a broken authentication caused by missing Host header validation and lack of throttling on failed admin sign-ins in the REST API listener, letting remote attackers perform brute-force attacks via DNS rebinding, exploit requires attacker to control a web page opened in the administrator's browser.
- 7.8 /10 HighCVE-2026-104658 Auth required
Progressive Robot hMailServer - Privilege Escalation
Progressive Robot hMailServer 6.3.4 and 6.3.5 contain a privilege escalation caused by the live-update apply helper running as root and executing attacker-controlled files from the unprivileged service account, letting attackers with service account code execution escalate to root, exploit requires prior code execution as hmailserver service account.
- 7.8 /10 HighCVE-2026-104078 No auth
Obsidian Desktop - Command Injection
Obsidian Desktop < 1.14.0 contains a command injection caused by a filter bypass in MathJax 3.2.2 Safe component via crafted href with TAB byte, letting attackers execute arbitrary OS commands, exploit requires victim to click malicious link.