Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 374 of 767
- 9.3 /10 CriticalCVE-2026-13043 PoC publicAuth required
WatchGuard Endpoint Security - Authentication Bypass
WatchGuard endpoint security contains a missing authentication vulnerability in Kernel Memory Access Driver (PSKMAD), letting local authenticated attackers bypass access control and disclose kernel and process memory.
- 9.8 /10 CriticalCVE-2026-12627
Fortra Core Privileged Access Manager - Buffer Overflow
Fortra Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow caused by improper handling in boks_autoregisterd, letting remote attackers with network access cause memory corruption, exploit requires network access to autoregistration service.
- 7.7 /10 HighCVE-2026-12544
Foreman - Server-Side Template Injection & Insecure Deserialization
Foreman contains a server-side template injection and insecure deserialization caused by multi-stage execution chain in foreman-rake initialization logic in /usr/share/foreman/config/settings.rb, letting remote attackers execute code and compromise infrastructure, exploit requires crafted input to configuration data.
- 8.2 /10 HighCVE-2026-12541 Auth required
Foreman - Command Injection
Foreman contains a command injection caused by improper sanitization of user-supplied input in foreman-rake db:dump and db:import_dump tasks, letting attackers with foreman-rake execution permissions run arbitrary OS commands.
- 8.2 /10 HighCVE-2026-12540 Auth required
Foreman - Command Injection
Foreman contains a command injection caused by inadequate shell neutralization of the request_id parameter in the foreman-rake errors:fetch_log task, letting attackers with sudo permissions execute arbitrary code.
- 7.5 /10 HighCVE-2026-12423 No auth
Foreman - Authentication Bypass
Foreman contains an authentication bypass caused by a semantic logic flaw in host_verifier.rb in the /unattended/provision API endpoint, letting attackers access kickstart templates without providing a token, exploit requires crafted request without token.
- 8.8 /10 HighCVE-2026-12405 Auth required
Red Hat Satellite - Command Injection
Red Hat Satellite API in rubygem-foreman_remote_execution contains a command injection caused by improper sanitization of the effective_user parameter in job templates marked as overridable, letting attackers with job execution permissions run arbitrary shell commands with execution user privileges, exploit requires permission to execute job templates.
- 9.8 /10 CriticalCVE-2026-104286 CISA KEVPoC publicNo auth
Fortinet FortiMail - Path Traversal
Fortinet FortiMail 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1 contain a path traversal vulnerability caused by improper limitation of pathname in HTTP/HTTPS request handling, letting unauthenticated attackers write arbitrary files on the system, exploit requires crafted HTTP/HTTPS requests.
- 8.1 /10 HighCVE-2026-104059 No auth
Lektor - Cross-Site Request Forgery
Lektor 3.3.14 and 3.4.0b15 contain a cross-site request forgery caused by lack of CSRF tokens, Origin/Referer validation, CORS configuration, and Host allowlisting in the admin API blueprint, letting unauthenticated attackers perform state-changing actions and data disclosure via DNS rebinding, exploit requires crafted cross-origin requests.
- 7.5 /10 HighCVE-2026-104057 No auth
Podgrab - Denial of Service
Podgrab contains an unauthenticated denial-of-service caused by unsynchronized concurrent access to shared maps in its WebSocket handler, letting remote attackers crash the process via data race, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-104056 No auth
Authlib - Open Redirect
Authlib <= 1.7.2 contains an open redirect vulnerability caused by caching discovery JSON metadata without validation or issuer-origin binding, letting attackers replace endpoint URLs with attacker-controlled values, exploit requires no special conditions.
- 8.2 /10 HighCVE-2026-104051 PoC publicNo auth
PictShare - Broken Access Control
PictShare < 3.7.1 contains an information disclosure vulnerability caused by the API::info() endpoint returning complete raw metadata without a field whitelist, letting unauthenticated attackers obtain secret delete_code and uploader metadata, exploit requires attacker to call the info API with a publicly visible file hash.
- 7.5 /10 HighCVE-2026-104020 No auth
Amazon Ion Python - Denial of Service
Amazon Ion Python < 0.15.0 contains a denial of service caused by uncontrolled recursion in the Ion reader, letting remote unauthenticated actors crash the application via crafted deeply nested Ion values.
- 8.8 /10 HighCVE-2026-104018 Auth required
Wind River VxWorks 7 - Privilege Escalation
Wind River VxWorks 7 <= 26.09 contains an improper privilege management vulnerability caused by missing privilege checks in the command shell, letting authenticated users with limited privileges escalate their privileges, exploit requires user authentication.
- 9.3 /10 CriticalCVE-2026-103922 PoC publicNo auth
Capacitor - Stored XSS
Capacitor 6.0.0 to 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1 contain a stored XSS caused by insufficient validation of WebView navigation guard path, letting attackers execute scripts with same-origin access, exploit requires victim to activate an untrusted link.