Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 228 of 695
- 8.8 /10 HighCVE-2026-76463 No auth
Cisco Networking - Broken Access Control
Cisco networking products contain improper access control vulnerabilities caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-76459 No auth
Cisco NX-OS - Out-of-Bounds Write
Cisco NX-OS contains out-of-bounds write vulnerabilities caused by improper bounds checking, letting attackers potentially corrupt memory or cause denial of service, exploit requires network access.
- 8.6 /10 HighCVE-2026-76458 No auth
Cisco NX-OS - Denial of Service
Cisco NX-OS contains improper handling of exceptional conditions (CWE-703) causing multiple vulnerabilities, letting attackers potentially cause denial of service or other impacts, exploit requires network access.
- 8.6 /10 HighCVE-2026-76457 No auth
Cisco NX-OS - Out-of-Bounds Read
Cisco NX-OS contains out-of-bounds read vulnerabilities (CWE-125) caused by improper bounds checking, letting attackers potentially read unauthorized memory, exploit requires network access.
- 8.6 /10 HighCVE-2026-76456 No auth
Cisco NX-OS - Input Validation
Cisco NX-OS contains an input validation vulnerability caused by improper validation of special elements in command processing, letting attackers potentially execute unintended commands or cause denial of service, exploit requires crafted command input.
- 9.8 /10 CriticalCVE-2026-76455 No auth
Cisco NX-OS - Broken Access Control
Cisco NX-OS contains improper access control vulnerabilities caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-76454 No auth
Cisco License On-Prem - Unrestricted File Upload & Denial of Service
Cisco License On-Prem contains an unrestricted file write and denial of service vulnerability caused by improper input validation and lack of authentication in the Smart Licensing Utility API, letting unauthenticated remote attackers write arbitrary files or cause DoS, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-76453
Cisco NX-OS - Improper Neutralization
Cisco NX-OS contains improper neutralization vulnerabilities (CWE-707) discovered internally, letting attackers potentially exploit these issues, exploit requires unspecified conditions.
- 9.8 /10 CriticalCVE-2026-76285
CVE-2026-76285
Improper Adherence to Coding Standards. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
- 9.8 /10 CriticalCVE-2026-76284
CVE-2026-76284
Improper Neutralization. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
- 7.6 /10 HighCVE-2026-76283
CVE-2026-76283
Protection Mechanism Failure. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
- 8.8 /10 HighCVE-2026-76282
CVE-2026-76282
Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
- 9.8 /10 CriticalCVE-2026-76268 PoC publicNo auth
Splunk Enterprise - Command Injection
Splunk Enterprise < 10.4.3 and < 10.2.7 contains a command injection caused by unauthenticated access to Patroni REST API on search head cluster members, letting unauthenticated attackers execute arbitrary OS commands remotely, exploit requires network access.
- 7.7 /10 HighCVE-2026-76266 Auth required
Splunk Enterprise - Command Injection & Privilege Escalation
Splunk Enterprise < 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux contains a command injection caused by trusting existing installation content during package upgrade, letting local users escalate privileges to root, exploit requires package upgrade after local modification.
- 9.8 /10 CriticalCVE-2026-62253 No auth
Homer - Authentication Bypass
Homer < 11.0.283 contains a broken authentication caused by JWT middleware functions allowing empty jwtSecret, letting attackers access protected API endpoints without authentication, exploit requires default configuration with empty jwtSecret.