Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 286 of 767

  • 9.8 /10 Critical
    CVE-2026-77900 No auth

    Azure App Service - Authentication Bypass

    Azure App Service contains a broken authentication caused by missing authentication for a critical function, letting unauthorized attackers execute code remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-75875 No auth

    IBM Guardium Data Protection - Remote Code Execution

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a path traversal vulnerability that allows remote attackers to execute arbitrary code by accessing unintended file paths, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-71895 Auth required

    Apache DolphinScheduler - Authorization Bypass

    Apache DolphinScheduler 3.2.0 to before 3.4.3 contains an authorization vulnerability caused by improper access control to Kubernetes configuration data, letting authenticated non-admin users retrieve sensitive kubeconfig credentials, exploit requires user authentication.

  • 7.1 /10 High
    CVE-2026-71183 Auth required

    Apache DolphinScheduler - Broken Access Control

    Apache DolphinScheduler < 3.4.3 contains an authorization vulnerability caused by missing access control enforcement in /unauth-datasource and /authed-datasource endpoints, letting authenticated users access unauthorized sensitive data source information, exploit requires user authentication.

  • 9.6 /10 Critical
    CVE-2026-69435 Auth required

    Azure SRE Agent - Broken Access Control

    Azure SRE Agent contains a broken access control vulnerability caused by missing authorization checks, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 7.5 /10 High
    CVE-2026-67693

    GnuTLS - Information Disclosure

    GnuTLS 3.8.13 contains an information disclosure vulnerability caused by failure to reject end-entity X.509 certificates with contradictory Key Usage and Extended Key Usage, letting attackers obtain sensitive information, exploit requires crafted certificates.

  • 7.1 /10 High
    CVE-2026-66479 No auth

    Liquid Web / StellarWP WPComplete - Stored XSS

    Liquid Web / StellarWP WPComplete <= 2.9.5.6 contains a stored XSS caused by insufficient input sanitization, letting attackers execute scripts via stored payloads, exploit requires victim interaction.

  • 8.1 /10 High
    CVE-2026-66087 Auth required

    Apache DolphinScheduler - Authorization Bypass

    Apache DolphinScheduler before 3.4.3 contains an authorization bypass caused by insufficient access control in task instance operations, letting authenticated users operate task instances in unauthorized projects, exploit requires user authentication.

  • 8.1 /10 High
    CVE-2026-66084 Auth required

    Apache DolphinScheduler - Authorization Bypass

    Apache DolphinScheduler < 3.4.3 contains an authorization bypass caused by improper verification of task definition ownership in the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint, letting authenticated users modify task definitions in unauthorized projects, exploit requires user authentication.

  • 8.8 /10 High
    CVE-2026-62142 No auth

    Melapress WP 2FA - Cross Site Request Forgery

    Melapress WP 2FA wp-2fa <= 4.1.0 contains a cross site request forgery vulnerability caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 7.5 /10 High
    CVE-2026-56866 No auth

    Go http.Transport - HTTP Request Smuggling

    Go http.Transport contains a cross-user response poisoning vulnerability caused by improper handling of HTTP/1 CONNECT requests with non-empty bodies, letting attackers cause connection desynchronization and response injection, exploit requires use of shared Transport in reverse proxies.

  • 9.8 /10 Critical
    CVE-2026-56857 No auth

    Windows - Path Traversal

    Windows file system operations Root.Mkdir and Root.MkdirAll contain a path traversal vulnerability caused by improper handling of junction points, letting attackers create directories outside the root, exploit requires a junction pointing to an empty location.

  • 8.0 /10 High
    CVE-2026-5048 Auth required

    Brocade SANnav - SQL Injection

    Brocade SANnav < 3.0.0a contains an SQL injection caused by improper sanitization of REST API query parameters, letting authenticated attackers inject malicious data.

  • 7.1 /10 High
    CVE-2026-50054 Auth required

    Zimbra Collaboration Suite - Authorization Bypass

    Zimbra Collaboration Suite contains an authorization flaw in GrantRightsRequest, letting authenticated attackers grant loginAs rights to other local accounts, enabling persistent mailbox access and mail-sending authority.

  • 7.5 /10 High
    CVE-2026-44031 No auth

    OFFIS DCMTK - Denial of Service

    OFFIS DCMTK 3.7.0 contains a denial of service caused by uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() when parsing deeply nested DICOM sequences, letting remote unauthenticated attackers crash the process via crafted datasets.