Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 314 of 767

  • 9.8 /10 Critical
    CVE-2026-76750 No auth

    HPE Networking ClearPass Policy Manager - Insecure Deserialization

    HPE Networking ClearPass Policy Manager contains an insecure deserialization vulnerability in the web interface, letting unauthenticated remote attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-76748 Auth required

    AOS-S - Privilege Escalation

    AOS-S API contains a privilege escalation vulnerability allowing authenticated read-only users to escalate privileges and gain administrative access, exploit requires authenticated read-only user access.

  • 9.1 /10 Critical
    CVE-2026-76747 No auth

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow caused by improper input handling in an affected interface, letting unauthenticated remote attackers expose sensitive memory and cause denial of service, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-76746

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow vulnerability allowing unauthenticated adjacent attackers to expose sensitive memory contents and cause denial of service, exploit requires attacker to be adjacent.

  • 9.6 /10 Critical
    CVE-2026-76745

    AOS-S - Remote Code Execution

    AOS-S contains memory corruption vulnerabilities reachable by unauthenticated adjacent attackers, letting them execute arbitrary code remotely, exploit requires network adjacency.

  • 9.8 /10 Critical
    CVE-2026-76744 No auth

    AOS-S - Buffer Overflow

    AOS-S contains a buffer overflow caused by improper input handling in an affected interface, letting unauthenticated remote attackers execute arbitrary code remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-76743

    AOS-S - Authentication Bypass

    AOS-S management interface contains an authentication bypass caused by improper authentication controls, letting unauthenticated remote attackers gain unauthorized access, exploit requires specific preconditions outside attacker control.

  • 9.8 /10 Critical
    CVE-2026-76742 No auth

    AOS-S - Authentication Bypass

    AOS-S contains an authentication bypass vulnerability in the web management interface, letting unauthenticated remote attackers gain unauthorized access, exploit requires no special conditions.

  • 7.7 /10 High
    CVE-2026-76105 No auth

    Dell Container Storage Modules - Data Tampering

    Dell Container Storage Modules < 1.18.0 contain a use of insufficiently random values vulnerability, letting unauthenticated local attackers tamper with information, exploit requires local access.

  • 7.2 /10 High
    CVE-2026-75962 No auth

    Post SMTP WordPress Plugin - Stored XSS

    Post SMTP WordPress plugin <= 4.0.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of 'user_email' parameter, letting unauthenticated attackers inject scripts in email logs, exploit requires WordPress Multisite with public registration enabled.

  • 9.8 /10 Critical
    CVE-2026-73278 No auth

    Gitea - Authentication Bypass

    Gitea contains a broken authentication vulnerability caused by missing WebAuthn challenge enforcement in OAuth2 and OpenID Connect sign-in paths when WebAuthn is the only second factor, letting attackers obtain full sessions without passkey verification, exploit requires authentication via external identity flow.

  • 7.3 /10 High
    CVE-2026-71168 Auth required

    Dell System Update - Remote Code Execution

    Dell System Update < 2.3.0.0 contains a path traversal caused by improper limitation of pathname to restricted directory, letting low privileged local attackers execute code remotely, exploit requires local access.

  • 7.1 /10 High
    CVE-2026-70411 No auth

    Dell Container Storage Modules - Broken Access Control

    Dell Container Storage Modules (CSM) < 1.18.0 contains a missing authentication for critical function caused by lack of authentication in csm-authorization-tenant gRPC service, letting unauthenticated adjacent network attackers create tenants, inject roles, and modify storage access control flags.

  • 7.5 /10 High
    CVE-2026-70357 No auth

    Gitea - Server Side Request Forgery

    Gitea contains a server-side request forgery caused by hostname validation bypass in repository migration, letting attackers control DNS to reach blocked internal addresses during Git clone, exploit requires ability to start migration and control destination DNS.

  • 9.6 /10 Critical
    CVE-2026-67273 Auth required

    Dell Container Storage Modules - Privilege Escalation

    Dell Container Storage Modules < 1.18.0 contain a template injection caused by improper neutralization of special elements in the template engine, letting low privileged remote attackers escalate privileges, exploit requires remote access.