Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 301 of 767

  • 8.1 /10 High
    CVE-2026-59347 No auth

    VMware Workstation and Fusion - Remote Code Execution

    VMware Workstation and Fusion 25H2, 26H1 contain a buffer overflow caused by a flaw in HGFS, letting local attackers with admin privileges on a VM execute code as the VMX process on the host, exploit requires local admin on VM.

  • 9.3 /10 Critical
    CVE-2026-59346 PoC publicNo auth

    VMware Workstation & Fusion - Integer Overflow

    VMware Workstation and Fusion 25H2 and 26H1 contain an integer overflow caused by improper handling in VMXNET3 virtual network adapter, letting local attackers with admin privileges on a VM execute code on the host, exploit requires local admin on VM.

  • 8.3 /10 High
    CVE-2026-58069 Auth required

    Veeam Backup & Replication - Broken Access Control

    Veeam Backup & Replication contains a file read vulnerability caused by improper access control, letting authenticated Cloud Connect tenants read arbitrary files on the service provider host, exploit requires tenant authentication.

  • 7.1 /10 High
    CVE-2026-5703 Auth required

    Satel Iberia SenNet Datalogger Serie 200 - Path Traversal

    Satel Iberia SenNet Datalogger Serie 200 contains a path traversal caused by URL manipulation in the web portal, letting authenticated users read arbitrary files or list directories accessible to the web server user.

  • 7.5 /10 High
    CVE-2026-56851 No auth

    Nickname profile - Denial of Service

    Nickname profile contains a buffer overflow caused by transforming crafted input into a short destination buffer, letting attackers cause application panic via out-of-bounds slice error, exploit requires crafted input.

  • 7.4 /10 High
    CVE-2026-46572 No auth

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_ib_cut_tail() in libntfs-3g/index.c, letting attackers corrupt heap memory via crafted NTFS images, exploit requires crafted directory.

  • 8.1 /10 High
    CVE-2026-46570 No auth

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_index_walk_down() in libntfs-3g/index.c, letting attackers corrupt heap memory via crafted NTFS image, exploit requires crafted file metadata.

  • 7.7 /10 High
    CVE-2026-46569 No auth

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_ib_copy_tail() in libntfs-3g/index.c, letting attackers corrupt heap memory via crafted NTFS images, exploit requires creating or extending a directory.

  • 7.1 /10 High
    CVE-2026-46434 Auth required

    wger - Broken Access Control

    wger < 2.6 contains a broken access control vulnerability caused by improper privilege checks in UserDeactivateView, letting gym_trainer users deactivate higher-privileged accounts, exploit requires gym_trainer permission.

  • 7.1 /10 High
    CVE-2026-43976 Auth required

    wger - Broken Access Control

    wger < 2.6 contains a broken access control caused by flawed gym-scope guard allowing trainers with specific permissions and no gym assignment to read private data of unaffiliated users, exploit requires trainer permissions and no gym assignment.

  • 7.6 /10 High
    CVE-2026-42721 Auth required

    SERVIT Software Solutions affiliate-toolkit - SQL Injection

    SERVIT Software Solutions affiliate-toolkit <= 3.9.1 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.

  • 7.6 /10 High
    CVE-2026-42720 Auth required

    Sarah Giles Dynamic User Directory - SQL Injection

    Sarah Giles Dynamic User Directory <= 2.4 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.6 /10 High
    CVE-2026-42714 Auth required

    Piggly Dev Pix por Piggly (para Woocommerce) - SQL Injection

    Piggly Dev Pix por Piggly (para Woocommerce) <= 2.1.2 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.

  • 7.6 /10 High
    CVE-2026-42713 Auth required

    Gopiplus Post title marquee scroll - SQL Injection

    Gopiplus Post title marquee scroll <= 9.9 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.

  • 7.6 /10 High
    CVE-2026-42710 Auth required

    10Web Slider - SQL Injection

    10Web Slider by 10Web <= 1.2.63 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.