Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 26 of 677
- 7.5 /10 HighCVE-2026-33795 No auth
Juniper Networks Junos OS & Junos OS Evolved - Denial of Service
Juniper Networks Junos OS and Junos OS Evolved >= 20.4R1 contain a denial of service caused by a numeric truncation error in the rpd process triggered by BGP Prefix-SID route advertisement, letting unauthenticated network attackers cause service disruption, exploit requires network access to send BGP advertisements.
- 9.8 /10 CriticalCVE-2026-33792 No auth
Juniper Networks Junos OS - Buffer Overflow
Juniper Networks Junos OS on SRX Series contains a stack-based buffer overflow caused by improper handling of crafted packets in the srxpfe process on GRE tunnels, letting unauthenticated network attackers execute code as root or cause denial of service.
- 9.8 /10 CriticalCVE-2026-33789 No auth
Juniper Networks Junos OS - Buffer Overflow
Juniper Networks Junos OS and Junos OS Evolved contain a stack-based buffer overflow caused by crafted BGP route updates in the routing protocol daemon (rpd) when BGP Monitoring Protocol (BMP) is enabled, letting unauthenticated BGP peers cause denial of service and potential root-level command execution, exploit requires BMP enabled.
- 7.1 /10 HighCVE-2026-19673 No auth
Zephyr OS - Out of Bounds Read/Write
Zephyr OS with CONFIG_NET_VLAN=y and VLAN enabled on Ethernet interfaces without hardware VLAN tag stripping contains a buffer length validation flaw in ethernet_recv() caused by improper length checks on VLAN tagged frames, letting remote attackers cause denial of service and out-of-bounds memory access, exploit requires crafted short VLAN tagged Ethernet frames.
- 8.1 /10 HighCVE-2026-17092 Auth required
Directorist AI-Powered Business Directory - Authorization Bypass
Directorist AI-Powered Business Directory plugin for WordPress <= 8.10.2.1 contains an authorization bypass caused by improper user authorization verification, letting authenticated subscribers delete arbitrary listings, exploit requires subscriber-level access.
- 9.8 /10 CriticalCVE-2026-16741 No auth
TR7 Cyber Defense Inc. TR7 ASP - OS Command Injection
TR7 Cyber Defense Inc. TR7 ASP on virtual and physical appliances from 1.0.40.236 < 1.0.1554.2331 and 1.6.42.239 < 1.6.1554.2331 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary commands remotely, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-16740 No auth
TR7 Cyber Defense Inc. TR7 ASP - OS Command Injection
TR7 Cyber Defense Inc. TR7 ASP on virtual and physical appliances from 1.0.40.236 < 1.0.1554.2331 and 1.6.42.239 < 1.6.1554.2331 contains an OS command injection caused by missing authentication for critical functions, letting attackers execute arbitrary OS commands remotely, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-15176 No auth
NGINX - Buffer Overflow
NGINX Plus and NGINX Open Source contain a heap buffer overflow caused by use of alias directive with rewrite and set or return referencing $request_filename, letting unauthenticated attackers cause DoS or code execution, exploit requires crafted HTTP requests.
- 7.5 /10 HighCVE-2026-15102 Auth required
ADP Desktop SDK - Information Disclosure
ADP Desktop SDK contains a clear text transmission vulnerability causing sensitive information exposure, letting attackers gain unauthorized access to Autodesk services, exploit requires network access.
- 9.2 /10 CriticalCVE-2026-14851 No auth
Customer Invoicing Web Application - Broken Access Control
A customer invoicing web application contains a broken access control vulnerability caused by lack of authorization checks on PDF invoice endpoints and publicly accessible URLs, letting attackers access confidential PII and financial data without authorization.
- 7.7 /10 HighCVE-2026-14765 No auth
Epic Games Unreal Engine - Command Injection
Epic Games Unreal Engine <= 5.8.0 contains a command injection caused by insecure default configuration of LaunchURL Blueprint node allowing execution of files via file:/// URI, letting attackers execute arbitrary commands, exploit requires loading user-generated content with malicious Blueprints.
- 7.1 /10 HighCVE-2026-110873 Auth required
Heym - Privilege Escalation
Heym 0.0.55 before 0.0.121 contains a privilege escalation caused by missing error_workflow_id from OWNER_ONLY_EXECUTION_FIELDS, letting shared collaborators overwrite error workflows and exfiltrate owner's decrypted credentials, exploit requires collaborator access.
- 7.5 /10 HighCVE-2026-110869 No auth
Nodemailer - Denial of Service
Nodemailer < 10.0.13 contains a regular expression denial of service caused by overlapping whitespace sub-patterns in SMTPConnection._actionEHLO AUTH mechanism detection regexes, letting a malicious or man-in-the-middle SMTP server block the Node.js event loop, exploit requires interaction with a malicious SMTP server.
- 8.5 /10 HighCVE-2026-110868 Auth required
Renovate - Server-Side Request Forgery
Renovate < 44.79.0 contains a server-side request forgery caused by allowing users to make shared HTTP client requests to arbitrary internal URLs via extends presets or customDatasources, letting attackers obtain AWS credentials or leak sensitive information through logs, exploit requires crafted presets or customDatasources.
- 8.5 /10 HighCVE-2026-110867 Auth required
Renovate - Allowlist Bypass
Renovate < 44.60.1 contains an allowlist bypass vulnerability caused by improper environment variable filtering in shared presets, letting attackers controlling external presets override restricted environment variables, exploit requires attacker control of external preset.