Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 294 of 767
- 7.5 /10 HighCVE-2026-105830 No auth
league/commonmark - Denial of Service
league/commonmark > 2.0.0 < 2.10.2 contains a denial of service caused by quadratic-time complexity in TableStartParser::tryStart() block-start scan in GitHub Flavored Markdown Table extension, letting unauthenticated attackers exhaust CPU by submitting large pipe-free paragraphs.
- 8.7 /10 HighCVE-2026-105674 No auth
TP-Link Tapo - Authentication Bypass
TP-Link Tapo C325WB V2 contains a predictable pre-shared key generation caused by a time-seeded pseudo-random number generator in the local media streaming service, letting unauthenticated adjacent-network attackers recover the key and authenticate without valid credentials.
- 7.1 /10 HighCVE-2026-105673 No auth
Tapo C325WB - Denial of Service
Tapo C325WB v2 contains a denial-of-service vulnerability caused by crafted RTSP-over-HTTP tunneling requests in the RTSP streaming service on TCP port 554 when Camera Account feature is enabled, letting unauthenticated adjacent-network attackers disrupt live video streaming, exploit requires Camera Account feature enabled.
- 8.7 /10 HighCVE-2026-105672
TP-Link Tapo - Authorization Bypass
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass caused by manipulation of onboarding-scoped objects in the HTTPS JSON API dispatcher on TCP port 443, letting adjacent-network attackers invoke privileged actions without authentication.
- 8.8 /10 HighCVE-2026-105436 No auth
MainWP MainWP Child - Insecure Deserialization
MainWP MainWP Child <= 6.2.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-105110 No auth
Iskratel Innbox GPON ONT - Command Injection
Iskratel Innbox GPON ONT contains a command injection caused by improper sanitization of the CLI parameter in the login.xgi CGI endpoint, letting unauthenticated remote attackers execute arbitrary commands as root.
- 7.6 /10 HighCVE-2026-105076 Auth required
Appsbd Vitepos - SQL Injection
Appsbd Vitepos vitepos-lite <= 3.6.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 7.4 /10 HighCVE-2026-104704
Progressive Robot hMailServer - Man-in-the-Middle
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a misconfiguration in TLS enforcement for outbound SMTP delivery caused by improper handling of DNSSEC-validated TLSA records, letting network attackers suppress STARTTLS and read or modify messages in cleartext, exploit requires active network position.
- 7.8 /10 HighCVE-2026-104660 Auth required
Progressive Robot hMailServer - Broken Access Control
Progressive Robot hMailServer 6.0.0 through 6.3.5 on Windows contains a broken access control vulnerability caused by missing authorization on COM objects, letting local users read/write arbitrary files and send mail as any sender without credentials, exploit requires local interactive access.
- 7.5 /10 HighCVE-2026-104659 No auth
Progressive Robot hMailServer - Authentication Bypass
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a broken authentication caused by missing Host header validation and lack of throttling on failed admin sign-ins in the REST API listener, letting remote attackers perform brute-force attacks via DNS rebinding, exploit requires attacker to control a web page opened in the administrator's browser.
- 7.8 /10 HighCVE-2026-104658 Auth required
Progressive Robot hMailServer - Privilege Escalation
Progressive Robot hMailServer 6.3.4 and 6.3.5 contain a privilege escalation caused by the live-update apply helper running as root and executing attacker-controlled files from the unprivileged service account, letting attackers with service account code execution escalate to root, exploit requires prior code execution as hmailserver service account.
- 7.8 /10 HighCVE-2026-104078 No auth
Obsidian Desktop - Command Injection
Obsidian Desktop < 1.14.0 contains a command injection caused by a filter bypass in MathJax 3.2.2 Safe component via crafted href with TAB byte, letting attackers execute arbitrary OS commands, exploit requires victim to click malicious link.
- 7.8 /10 HighCVE-2026-104077 No auth
Obsidian Desktop - Remote Code Execution
Obsidian Desktop < 1.14.0 contains a remote code execution caused by insufficient sanitization of the data-background-iframe attribute in Reveal.js 4.3.1 within the Slides core plugin, letting attackers execute arbitrary OS commands when victims open malicious Markdown notes and start presentations.
- 9.1 /10 CriticalCVE-2026-104076 No auth
TVU Networks Receiver/Transceiver - Authentication Bypass
TVU Networks Receiver/Transceiver devices < 7.9 contain a missing authentication vulnerability caused by unprotected REST API endpoints on port 8288, letting remote unauthenticated attackers read sensitive information and modify device configuration.
- 9.8 /10 CriticalCVE-2026-104075 No auth
TVU Networks Receiver/Transceiver - Authentication Bypass
TVU Networks Receiver/Transceiver devices < 7.9 contain an authentication bypass caused by improper validation of the UserName parameter in the web management login endpoint, letting remote unauthenticated attackers gain administrative sessions, exploit requires crafted HTTP request.