Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 337 of 767
- 7.5 /10 HighCVE-2026-103670 No auth
Gitea - Broken Access Control
Gitea contains a broken access control vulnerability caused by improper concurrency group run cancellation logic in Actions, letting fork pull request users cancel trusted in-progress runs without approval, exploit requires fork pull request creation.
- 8.1 /10 HighCVE-2026-103504 Auth required
Organization Team API - Broken Access Control
An organization team's permission change via API with only the 'permission' field does not rebuild per-unit access, letting organization owners unintentionally retain higher access levels, exploit requires organization owner privileges.
- 7.1 /10 HighCVE-2026-103346 No auth
Tomlister Payflex Payment Gateway - Reflected XSS
Tomlister Payflex Payment Gateway <= 2.7.1 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted request.
- 9.1 /10 CriticalCVE-2026-103059
Gitea - Authentication Bypass
Gitea contains a broken authentication caused by case-insensitive SQL LIKE comparison of SSH public keys, letting attackers with derived private keys authenticate as other users, exploit requires SSH server enabled.
- 7.1 /10 HighCVE-2026-103009 Auth required
Elasticsearch - Authorization Bypass
Elasticsearch contains an authorization bypass caused by inconsistent shard identifier validation in cross-cluster search requests using Remote Cluster Security 2.0, letting attackers with cross-cluster API keys access unauthorized index data, exploit requires crafted cross-cluster search requests with mismatched shard identifiers.
- 7.2 /10 HighCVE-2026-103007 Auth required
Elasticsearch - Broken Access Control
Elasticsearch contains an incorrect authorization vulnerability caused by improper enforcement of delegated administrative privilege scope during authorization checks, letting delegated users escalate privileges to access restricted indices, exploit requires delegated role-management privilege.
- 8.5 /10 HighCVE-2026-102915 Auth required
WPO365 - Broken Access Control
WPO365 <= 44.1 contains a broken access control vulnerability caused by improper authorization checks, letting attackers access or modify restricted subscriber data, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-102406 Auth required
Kibana - Authorization Bypass
Kibana contains an authorization bypass through user-controlled key caused by improper verification of data stream ownership in Fleet package installation, letting attackers with delegated Fleet package-management privileges intercept and modify cross-tenant data streams, exploit requires delegated Fleet package-management privileges without Elasticsearch admin rights.
- 7.5 /10 HighCVE-2026-102387 No auth
Xserver Migrator - Sensitive Data Exposure
Xserver Migrator <= 1.6.6 contains an unauthenticated sensitive data exposure vulnerability, letting unauthenticated attackers access sensitive information remotely, exploit requires no authentication.
- 9.6 /10 CriticalCVE-2026-102322 No auth
Google Chrome - Broken Access Control
Google Chrome < 155.0.8059.39 contains an incorrect authorization vulnerability in SiteIsolation, letting remote attackers execute arbitrary code via crafted HTML pages, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-102167
Arista Wi-Fi access points - Remote Code Execution & Denial of Service
Arista Wi-Fi access points contain a memory corruption vulnerability in wired uplink network endpoints, letting unauthenticated attackers crash the sensor service or achieve remote code execution, exploit requires attacker on same network segment.
- 7.5 /10 HighCVE-2026-102165
Arista Wi-Fi - Remote Code Execution
Arista Wi-Fi access points contain a remote code execution caused by crafted packets sent to the capture service in a non-default streaming mode, letting unauthenticated attackers with network access execute code remotely, exploit requires non-default streaming mode.
- 8.8 /10 HighCVE-2026-102163 No auth
Arista Access Points - Denial of Service & Remote Code Execution
Arista access points with Wireless Intrusion Prevention System (WIPS) active contain a denial of service and potential remote code execution vulnerability caused by crafted frames sent by unauthenticated attackers within RF proximity, letting attackers crash the sensor service or execute code remotely, exploit requires RF proximity without authentication.
- 8.8 /10 HighCVE-2026-102162 No auth
Arista Wi-Fi Access Points - Buffer Overflow
Arista Wi-Fi access points with captive portal or application firewall enabled contain a stack overflow in the wireless gateway service, letting unauthenticated network-adjacent attackers cause denial-of-service or execute arbitrary code, exploit requires crafted packet.
- 8.8 /10 HighCVE-2026-102161 No auth
CV-CUE - Authentication Bypass
CV-CUE contains an authentication bypass caused by source IP address forgery in client headers, letting unauthenticated attackers on adjacent networks gain administrative session privileges, exploit requires attacker to be on adjacent private network or routed through a reverse proxy.