Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 37 of 677

  • 8.2 /10 High
    CVE-2026-102695 No auth

    OmniFaces - Broken Access Control

    OmniFaces < 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2 contains an information disclosure and denial of service vulnerability caused by acceptance of forged combined resource IDs without server verification in CombinedResourceHandler, letting attackers cause memory exhaustion and disclose Facelets source, exploit requires crafted forged resource ID.

  • 8.7 /10 High
    CVE-2026-102479 No auth

    Eclipse Vert.x - HTTP Request Smuggling

    Eclipse Vert.x 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains an HTTP request smuggling vulnerability caused by improper canonicalization of HTTP/1.x headers in io.vertx:vertx-core, letting attackers perform request smuggling via crafted headers.

  • 9.1 /10 Critical
    CVE-2026-102476 No auth

    Eclipse Vert.x - Misconfiguration

    Eclipse Vert.x versions 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contain an insecure SSL context caching caused by improper SSL property handling in the Vert.x HTTP client, letting attackers obtain SSL contexts with weaker security properties, exploit requires client to request SSL context.

  • 8.6 /10 High
    CVE-2026-102460 Auth required

    Eclipse Vert.x Web - Broken Access Control

    Eclipse Vert.x Web versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contain a broken access control vulnerability caused by ChainAuthHandler skipping scope validation for pre-authenticated users, letting attackers with valid tokens but insufficient scopes bypass scope restrictions, exploit requires pre-authentication by an earlier handler.

  • 7.5 /10 High
    CVE-2026-102298 Auth required

    Omada Controller - Broken Access Control

    Omada Controller MSP mode contains a broken access control caused by missing permission checks in the user-confirmation endpoint, letting authenticated users enumerate users and verify credentials, exploit requires authentication.

  • 7.5 /10 High
    CVE-2026-102251 No auth

    Abandoned Cart Pro for WooCommerce - SQL Injection

    Abandoned Cart Pro for WooCommerce <= 10.8.0 contains a SQL injection caused by insufficient escaping of the 'validate' parameter and lack of query preparation, letting unauthenticated attackers extract sensitive data, exploit requires crafted SQL injection via 'validate' parameter.

  • 7.5 /10 High
    CVE-2026-102185 No auth

    Juniper Networks Junos OS - Denial of Service

    Juniper Networks Junos OS and Junos OS Evolved contain an infinite loop vulnerability in the routing protocol daemon (rpd) caused by EVPN multihoming with preference-based designated-forwarder election, letting remote attackers cause denial of service, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-102184 No auth

    Juniper Networks Junos OS - Denial of Service

    Juniper Networks Junos OS and Junos Evolved contain a denial of service caused by improper validation of specified quantity in malformed SRv6 structure in EVPN route update, letting configured EVPN signaling peers crash rpd daemon, exploit requires configured EVPN signaling peer.

  • 7.5 /10 High
    CVE-2026-102183 No auth

    Juniper Networks Junos OS - Denial of Service

    Juniper Networks Junos OS and Junos OS Evolved contain an improper validation of specified quantity in input vulnerability caused by malformed NLRI in the routing protocol daemon (rpd), letting configured BGP EVPN peers cause rpd crash, exploit requires configured BGP EVPN peer.

  • 9.8 /10 Critical
    CVE-2026-102182 No auth

    Juniper Networks Junos OS - Remote Code Execution

    Juniper Networks Junos OS on MX Series < 21.2R3-S11, 21.4 < 21.4R3-S12, 22.2 < 22.2R3-S8, 22.3 < 22.3R3-S5, 22.4 < 22.4R3-S9 contains a stack-based buffer overflow caused by improper handling of IKE certificate-based packets in the kmd component, letting unauthenticated network attackers execute code as root remotely, exploit requires crafted IKE certificate-based packets.

  • 7.5 /10 High
    CVE-2026-102180 No auth

    Juniper Networks Junos OS & Junos OS Evolved - Denial of Service

    Juniper Networks Junos OS and Junos OS Evolved >= 22.1R1 contain a stack-based buffer overflow caused by processing crafted BGP route attributes during active BGP RIB streaming telemetry subscriptions, letting attackers with BGP peering access cause denial of service.

  • 7.5 /10 High
    CVE-2026-102179 No auth

    Juniper Networks Junos OS - Denial of Service

    Juniper Networks Junos OS and Junos OS Evolved contain an out-of-bounds write vulnerability in the routing protocol daemon (rpd) caused by BGP EVPN route processing with l2vpn-evpn RIB telemetry sensor subscription, letting attackers with access to a configured BGP EVPN peer cause denial of service, exploit requires access to a configured BGP EVPN peer.

  • 9.8 /10 Critical
    CVE-2026-102178 No auth

    Juniper Networks Junos OS - Buffer Overflow

    Juniper Networks Junos OS and Junos OS Evolved contain a stack-based buffer overflow caused by flowspec route re-advertisement in BGP routing daemon with BGP update-threading enabled, letting configured BGP flowspec peers cause routing-engine compromise or denial of service, exploit requires configured BGP flowspec peer.

  • 7.6 /10 High
    CVE-2026-102177 No auth

    Juniper Networks Junos OS - Denial of Service

    Juniper Networks Junos OS and Junos OS Evolved contain an out-of-bounds write vulnerability in the routing protocol daemon (rpd), letting adjacent unauthenticated attackers cause denial of service when IS-IS link protection and backup-selection are configured.

  • 8.8 /10 High
    CVE-2026-102176 No auth

    Juniper Networks Junos OS - Buffer Overflow

    Juniper Networks Junos OS contains a buffer overflow caused by unchecked buffer copy in the SDK service process, letting unauthenticated network attackers cause denial of service or compromise the Routing Engine, exploit requires SDK service and JDAF routing instance enabled.