Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 223 of 695

  • 7.8 /10 High
    CVE-2026-104077 No auth

    Obsidian Desktop - Remote Code Execution

    Obsidian Desktop < 1.14.0 contains a remote code execution caused by insufficient sanitization of the data-background-iframe attribute in Reveal.js 4.3.1 within the Slides core plugin, letting attackers execute arbitrary OS commands when victims open malicious Markdown notes and start presentations.

  • 9.1 /10 Critical
    CVE-2026-104076 No auth

    TVU Networks Receiver/Transceiver - Authentication Bypass

    TVU Networks Receiver/Transceiver devices < 7.9 contain a missing authentication vulnerability caused by unprotected REST API endpoints on port 8288, letting remote unauthenticated attackers read sensitive information and modify device configuration.

  • 9.8 /10 Critical
    CVE-2026-104075 No auth

    TVU Networks Receiver/Transceiver - Authentication Bypass

    TVU Networks Receiver/Transceiver devices < 7.9 contain an authentication bypass caused by improper validation of the UserName parameter in the web management login endpoint, letting remote unauthenticated attackers gain administrative sessions, exploit requires crafted HTTP request.

  • 9.8 /10 Critical
    CVE-2026-103692 No auth

    Frontend Dashboard WordPress - Broken Access Control

    Frontend Dashboard WordPress plugin < 3.0.5 contains a broken access control vulnerability caused by lack of authorization and nonce checks on actions, letting unauthenticated attackers take over any account including administrators.

  • 9.4 /10 Critical
    CVE-2026-103663

    Ollama - Path Traversal & Remote Code Execution

    Ollama < 0.35.0 contains a path traversal caused by insufficient validation of layer digests in /api/pull endpoint, letting unauthenticated remote attackers write malicious files outside the model store, leading to remote code execution as root, exploit requires server process write access to /usr/lib/ollama.

  • 7.5 /10 High
    CVE-2026-103649 No auth

    Progressive Robot hMailServer - Denial of Service

    Progressive Robot hMailServer 6.3.0 through 6.3.5 Linux builds contain a denial of service caused by missing network timeouts in socket handling, letting remote attackers hold server threads indefinitely, exploit requires sending crafted mail to trigger outbound delivery to attacker-controlled domains.

  • 8.0 /10 High
    CVE-2026-103647 No auth

    Progressive Robot hMailServer - Stored XSS

    Progressive Robot hMailServer 6.3.2 through 6.3.5 contains a stored XSS caused by unsafe rendering of decrypted S/MIME or OpenPGP message attachments as blob URLs in webmail, letting remote attackers execute scripts in the user's session, exploit requires REST API enabled.

  • 9.8 /10 Critical
    CVE-2026-103646 No auth

    Ultimate Multisite WordPress - Authentication Bypass

    Ultimate Multisite WordPress plugin < 2.17.0 contains an authentication bypass caused by inconsistent email normalization in duplicate-account check, letting unauthenticated attackers log in as existing users, exploit requires checkout form without password and target account without customer record.

  • 7.5 /10 High
    CVE-2026-103309 No auth

    GPTranslate WordPress - Stored XSS

    GPTranslate WordPress plugin < 2.34.14 contains a stored XSS caused by improper restriction and escaping of stored translations, letting unauthenticated attackers execute scripts on translated pages, exploit requires server-side translations enabled.

  • 7.8 /10 High
    CVE-2026-103010 Auth required

    Progressive Robot hMailServer - Buffer Overflow

    Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows contains a heap-based buffer overflow caused by unchecked long hexadecimal input in the BlowFishEncryptor::DecryptFromString routine, letting local users write beyond buffer limits, potentially causing denial of service or code execution, exploit requires local access without authentication.

  • 8.7 /10 High
    CVE-2026-102784 No auth

    Joomla Extension balbooa.com Gridbox - Cross-Site Request Forgery

    Joomla Extension balbooa.com Gridbox < 2.20.4.0 contains a cross-site request forgery caused by missing session token validation on GET requests in the addLanguage action, letting attackers perform unauthorized actions with victim's privileges, exploit requires victim to have core.tools permission.

  • 8.7 /10 High
    CVE-2026-102488 Auth required

    Octopus Server - Broken Access Control

    Octopus Server contains a broken access control caused by incorrect evaluation of multiple scoped permission assignments, letting highly privileged users obtain deployment permissions beyond their granted scope, exploit requires high privilege user access.

  • 8.8 /10 High
    CVE-2026-101024 Auth required

    Satel Netco Design - Path Traversal

    Satel Netco Design < 2.1.7 contains a path traversal caused by improper validation in data export functionality, letting authenticated users with Viewer privileges write files, potentially leading to unauthorized file modification or code execution.

  • 9.1 /10 Critical
    CVE-2026-97720 No auth

    Apache Impala - Authentication Bypass

    Apache Impala <= 4.5.2 contains a broken authentication caused by improper JWT/OAuth token signature validation in executor webserver, letting attackers access protected resources, exploit requires webserver configured to accept JWT/OAuth tokens.

  • 8.7 /10 High
    CVE-2026-97716 No auth

    Secure Access - Denial of Service

    Secure Access servers < 14.60 contain a denial of service caused by specially crafted traffic in the connection setup sub-system, letting unauthenticated attackers cause persistent service disruption, exploit requires no special privileges.