Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 302 of 767

  • 7.6 /10 High
    CVE-2026-42708 Auth required

    AF themes WP Post Author - SQL Injection

    AF themes WP Post Author <= 4.0.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-42618 Auth required

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_decompress() in compress.c, letting attackers corrupt heap memory by reading a specially crafted NTFS image, exploit requires crafted file access.

  • 7.1 /10 High
    CVE-2026-42617 Auth required

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_ir_to_ib() in index.c, letting attackers corrupt heap memory via crafted NTFS images, exploit requires file creation in a directory.

  • 7.8 /10 High
    CVE-2026-42616 No auth

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in cat() function in ntfscat.c, letting attackers corrupt heap memory by reading a crafted malicious NTFS image, exploit requires crafted NTFS image.

  • 8.5 /10 High
    CVE-2026-34499

    Johnson Controls ADVMS - Hardcoded Credentials

    Johnson Controls ADVMS < 3.10 contains a hardcoded cryptographic key vulnerability caused by embedded keys in the executable, letting attackers read sensitive constants within the executable, exploit requires access to the executable.

  • 7.2 /10 High
    CVE-2026-20362 No auth

    Cisco Finesse - Server-Side Request Forgery

    Cisco Finesse contains a server-side request forgery caused by improper input validation in the web-based management interface, letting unauthenticated remote attackers obtain limited sensitive information, exploit requires crafted HTTP request.

  • 9.1 /10 Critical
    CVE-2026-20328 No auth

    Cisco License On-Prem - Authentication Bypass

    Cisco License On-Prem contains a broken authentication caused by improper checks during the password reset process, letting unauthenticated remote attackers reset arbitrary user passwords and gain unauthorized access, exploit requires sending a crafted request to the web interface.

  • 9.3 /10 Critical
    CVE-2026-19572 No auth

    FlexNet Publisher lmadmin - Authentication Bypass

    FlexNet Publisher lmadmin contains an authentication bypass caused by a hardcoded SOAP handler, letting unauthenticated attackers obtain privileged administrator sessions without valid credentials.

  • 7.7 /10 High
    CVE-2026-19396

    ASUS RT-BE57 Router - Authentication Bypass

    ASUS RT-BE57 router contains a predictable seed vulnerability in the PRNG used for IFTTT pairing token generation, letting unauthenticated nearby attackers derive tokens to read or modify router settings, exploit requires proximity to observe pairing session.

  • 9.3 /10 Critical
    CVE-2026-19386 Auth required

    ASUS Router - Buffer Overflow

    ASUS Router contains a stack-based buffer overflow caused by crafted configuration file upload exceeding buffer size, letting authenticated nearby attackers execute arbitrary code.

  • 8.1 /10 High
    CVE-2026-19186

    Zephyr IEEE802154 - Out-of-Bounds Read & Write

    Zephyr subsys/net/l2/ieee802154 contains an out-of-bounds read and write caused by improper length validation in ieee802154_decipher_data_frame(), letting remote attackers cause memory corruption and denial of service by sending crafted short frames, exploit requires enabled CONFIG_NET_L2_IEEE802154_SECURITY with crypto device and active security session.

  • 8.4 /10 High
    CVE-2026-16528 Auth required

    ASUS Router - Authentication Bypass

    ASUS routers contain an insertion of sensitive information into log files caused by improper logging of DDNS credentials, letting remote authenticated attackers obtain credentials and potentially modify DNS settings, exploit requires authentication.

  • 7.4 /10 High
    CVE-2026-16516

    wolfSSH - Man-in-the-Middle

    wolfSSH contains a man-in-the-middle vulnerability caused by improper validation of ECDSA curve identifiers in KEXDH_REPLY host key blobs, letting active network attackers bypass signature verification, exploit requires active MitM and lax public key checks.

  • 8.8 /10 High
    CVE-2026-15894 No auth

    Zephyr Bluetooth Mesh - Buffer Overflow

    Zephyr Bluetooth Mesh On-Demand Private Proxy (CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled) contains a buffer overflow caused by copying an oversized Solicitation PDU into a fixed 17-byte stack buffer without length bounds, letting remote attackers send crafted unauthenticated advertisements to cause stack overwrite, exploit requires attacker to be in radio range.

  • 9.3 /10 Critical
    CVE-2026-14911 No auth

    ASUS Router - Stored XSS

    ASUS router modules contain a stored XSS caused by improper neutralization of input during web page generation, letting remote attackers read DOM information, modify settings, and cause denial of service when an authenticated user visits a crafted URL.