Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 242 of 695

  • 9.8 /10 Critical
    CVE-2026-76753 No auth

    HPE Networking ClearPass Policy Manager - Remote Code Execution

    HPE Networking ClearPass Policy Manager contains a format string vulnerability in a service interface, letting unauthenticated remote attackers corrupt process memory and execute arbitrary code, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-76752 No auth

    HPE Networking ClearPass Policy Manager - Authentication Bypass

    HPE Networking ClearPass Policy Manager contains an authentication bypass caused by flaws in web-based management and API interfaces, letting unauthenticated remote attackers gain administrative access, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-76751 No auth

    ClearPass Policy Manager OnGuard - Remote Code Execution

    ClearPass Policy Manager OnGuard agent contains a missing integrity verification vulnerability, letting unauthenticated remote attackers execute arbitrary code with elevated agent privileges, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-76750 No auth

    HPE Networking ClearPass Policy Manager - Insecure Deserialization

    HPE Networking ClearPass Policy Manager contains an insecure deserialization vulnerability in the web interface, letting unauthenticated remote attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-76748 Auth required

    AOS-S - Privilege Escalation

    AOS-S API contains a privilege escalation vulnerability allowing authenticated read-only users to escalate privileges and gain administrative access, exploit requires authenticated read-only user access.

  • 9.1 /10 Critical
    CVE-2026-76747 No auth

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow caused by improper input handling in an affected interface, letting unauthenticated remote attackers expose sensitive memory and cause denial of service, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-76746

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow vulnerability allowing unauthenticated adjacent attackers to expose sensitive memory contents and cause denial of service, exploit requires attacker to be adjacent.

  • 9.6 /10 Critical
    CVE-2026-76745

    AOS-S - Remote Code Execution

    AOS-S contains memory corruption vulnerabilities reachable by unauthenticated adjacent attackers, letting them execute arbitrary code remotely, exploit requires network adjacency.

  • 9.8 /10 Critical
    CVE-2026-76744 No auth

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow caused by improper input handling in an affected interface, letting unauthenticated remote attackers execute arbitrary code remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-76743

    AOS-S - Authentication Bypass

    AOS-S management interface contains an authentication bypass caused by improper authentication controls, letting unauthenticated remote attackers gain unauthorized access, exploit requires specific preconditions outside attacker control.

  • 9.8 /10 Critical
    CVE-2026-76742 No auth

    AOS-S - Authentication Bypass

    AOS-S contains an authentication bypass vulnerability in the web management interface, letting unauthenticated remote attackers gain unauthorized access, exploit requires no special conditions.

  • 7.7 /10 High
    CVE-2026-76105 No auth

    Dell Container Storage Modules - Data Tampering

    Dell Container Storage Modules < 1.18.0 contain a use of insufficiently random values vulnerability, letting unauthenticated local attackers tamper with information, exploit requires local access.

  • 7.2 /10 High
    CVE-2026-75962 No auth

    Post SMTP WordPress Plugin - Stored XSS

    Post SMTP WordPress plugin <= 4.0.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of 'user_email' parameter, letting unauthenticated attackers inject scripts in email logs, exploit requires WordPress Multisite with public registration enabled.

  • 9.8 /10 Critical
    CVE-2026-73278 No auth

    Gitea - Authentication Bypass

    Gitea contains a broken authentication vulnerability caused by missing WebAuthn challenge enforcement in OAuth2 and OpenID Connect sign-in paths when WebAuthn is the only second factor, letting attackers obtain full sessions without passkey verification, exploit requires authentication via external identity flow.

  • 7.3 /10 High
    CVE-2026-71168 Auth required

    Dell System Update - Remote Code Execution

    Dell System Update < 2.3.0.0 contains a path traversal caused by improper limitation of pathname to restricted directory, letting low privileged local attackers execute code remotely, exploit requires local access.