Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 235 of 695

  • 7.2 /10 High
    CVE-2026-102173 No auth

    Kirki Freeform Page Builder - Stored XSS

    Kirki Freeform Page Builder plugin for WordPress <= 6.3.1 contains a stored cross-site scripting caused by insufficient escaping in ExceptionalElements::image_element() concatenating user-meta into img src attribute, letting unauthenticated attackers execute arbitrary scripts, exploit requires public user registration and a published page with kirki-register element.

  • 7.7 /10 High
    CVE-2026-101331 Auth required

    IBM Langflow OSS - Information Disclosure

    IBM Langflow OSS 1.0.0 through 1.12.2 contains an information disclosure vulnerability caused by insufficiently protected credentials, letting remote authenticated attackers obtain sensitive information, exploit requires authentication.

  • 8.8 /10 High
    CVE-2025-70522 No auth

    Fanvil x7a - Cross-Site Request Forgery

    Fanvil x7a firmware version 2.6.0.1182 contains a cross-site request forgery vulnerability caused by lack of cross-origin resource protection in request handler, letting attackers perform state-changing requests across origins, exploit requires victim interaction.

  • 9.8 /10 Critical
    CVE-2025-70521 No auth

    Fanvil x7a - Command Injection

    Fanvil x7a firmware version 2.6.0.1182 contains a command injection vulnerability caused by insecure handling of user-supplied input in the management portal's diagnostic ping tool, letting unauthenticated attackers execute arbitrary code on the underlying Android OS, exploit requires no authentication.

  • 10.0 /10 Critical
    CVE-2025-70518 No auth

    Fanvil x7a - Command Injection

    Fanvil x7a firmware version 2.6.0.1182 contains a command injection caused by insecure handling of user input in the management portal's diagnostic ping tool, letting unauthenticated attackers execute arbitrary code on the underlying Android OS, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2025-70517 No auth

    Fanvil x7a - Cross-Site Request Forgery

    Fanvil x7a firmware version 2.6.0.1182 contains a cross-site request forgery vulnerability caused by lack of cross-origin resource protection on state-changing requests, letting attackers perform unauthorized actions via CSRF.

  • 9.1 /10 Critical
    CVE-2025-70516 No auth

    Fanvil x7a - Broken Access Control

    Fanvil x7a firmware version 2.6.0.1182 contains a broken access control caused by lack of authentication restrictions in the websocket handler, letting unauthenticated users view device resources and perform diagnostic requests, exploit requires no authentication.

  • 9.4 /10 Critical
    CVE-2025-64393 Auth required

    Veeam Backup & Replication - Remote Code Execution

    Veeam Backup & Replication contains a remote code execution caused by privilege escalation vulnerability, letting a Backup Viewer execute arbitrary code as SYSTEM on the backup server, exploit requires Backup Viewer privileges.

  • 7.8 /10 High
    CVE-2026-98369 Auth required

    Linux Kernel - Race Condition

    Linux kernel contains an RCU usage issue in xfrm_trans_reinject caused by missing rcu_read_lock(), skb_dst_force(), and dev_hold() calls, letting attackers cause race conditions or memory corruption, exploit requires triggering specific packet reinjection via workqueue.

  • 7.8 /10 High
    CVE-2026-98368 Auth required

    Linux Kernel - Use After Free

    Linux kernel contains a use-after-free and memory leak vulnerability caused by improper handling of zerocopy managed skb frags in ESP output path, letting attackers cause memory corruption and resource leaks, exploit requires crafted network packets.

  • 7.8 /10 High
    CVE-2026-98367

    Linux Kernel RDMA/siw - Use After Free

    Linux kernel RDMA/siw contains a use-after-free caused by improper locking and cleanup in siw_accept and siw_qp_modify functions, letting concurrent attackers cause memory corruption, exploit requires concurrent access to QP state.

  • 7.8 /10 High
    CVE-2026-98366 Auth required

    Linux Kernel RDMA/rxe - Use After Free

    Linux kernel RDMA/rxe contains a use-after-free caused by improper validation of access flags before reassigning MR's PD in rxe_rereg_user_mr(), letting local attackers cause memory corruption, exploit requires local access.

  • 9.8 /10 Critical
    CVE-2026-98365 No auth

    Linux kernel RDMA/rxe - Integer Overflow

    Linux kernel RDMA/rxe contains an integer overflow in mr_check_range() caused by wraparound-prone arithmetic, letting remote unauthenticated peers trigger out-of-bounds read/write and kernel crash, exploit requires crafted RDMA-Write/Read RETH.

  • 7.8 /10 High
    CVE-2026-98364 Auth required

    Linux Kernel - Use After Free

    Linux kernel contains a use-after-free vulnerability in xfrm bundle creation caused by improper handling of net_device references under RCU, letting local attackers cause memory corruption, exploit requires concurrent RTM_DELLINK operation.

  • 7.8 /10 High
    CVE-2026-98361 Auth required

    Linux Kernel - Broken Access Control

    Linux kernel contains a broken access control vulnerability in RDMA/rxe ODP write paths caused by missing HMM_PFN_WRITE check, letting unprivileged users overwrite read-only page cache via RDMA, exploit requires unprivileged user registering ODP MR over read-only mappings.