Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 394 of 767

  • 7.2 /10 High
    CVE-2026-18145 Auth required

    WatchGuard Fireware OS - Buffer Overflow

    WatchGuard Fireware OS contains a buffer overflow caused by improper handling in the spamBlocker (spamd) service, letting authenticated administrators crash the service or execute arbitrary code remotely, exploit requires admin privileges.

  • 7.2 /10 High
    CVE-2026-13046 Auth required

    WatchGuard Fireware OS - Insecure Deserialization

    WatchGuard Fireware OS contains an insecure deserialization vulnerability in SAML single sign-on session handling (samld), letting attackers with file write access execute arbitrary code via crafted session files.

  • 8.7 /10 High
    CVE-2026-10764 No auth

    BVMS - Information Disclosure

    BVMS 4.5 up to 12.3 contains an information disclosure caused by insufficient protection against man-in-the-middle attacks, letting attackers gain unauthorized access to sensitive data, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-103591 No auth

    DeepWiki-Open - Arbitrary File Read

    DeepWiki-Open contains an unauthenticated arbitrary file read vulnerability caused by improper validation of the repo_url parameter in the GET /codemap/file endpoint, letting attackers read any file accessible to the API process, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-103475 No auth

    yii2-starter-kit - Broken Access Control

    yii2-starter-kit through 4.2.0 contains a broken access control caused by allowedIPs set to ['*'] in debug and Gii modules, letting unauthenticated remote attackers read sensitive data and write PHP files, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-103474 Auth required

    yii2-starter-kit - Unrestricted File Upload

    yii2-starter-kit <= 4.2.0 contains an unrestricted file upload caused by failure to validate file types in backend storage upload actions, letting authenticated managers upload and execute arbitrary PHP code, exploit requires manager role.

  • 8.1 /10 High
    CVE-2026-103473 No auth

    Deno - Command Injection

    Deno 2.7.0 through 2.9.7 on Windows contains a command injection caused by incorrect shell argument escaping in node:child_process, letting attackers execute arbitrary OS commands with Deno process privileges, exploit requires passing untrusted arguments with shell option.

  • 7.5 /10 High
    CVE-2026-103472 No auth

    restbed - Denial of Service

    restbed through 5.0.0 contains a denial of service caused by accepting WebSocket frames with unbounded payload lengths, letting remote unauthenticated attackers exhaust server memory, exploit requires sending large frame sizes.

  • 7.5 /10 High
    CVE-2026-103471 No auth

    restbed - Denial of Service

    restbed <= 5.0.0 contains a denial of service caused by unbounded buffering of HTTP request headers without size limit, letting remote unauthenticated attackers exhaust server memory by streaming bytes indefinitely, exploit requires open TCP connection.

  • 7.4 /10 High
    CVE-2026-103446 PoC publicAuth required

    The Wikimedia Foundation MediaWiki WikiLambda - Authentication Bypass

    The Wikimedia Foundation MediaWiki WikiLambda extension 1.46 contains an authentication bypass caused by user-controlled key vulnerability, letting attackers bypass authentication, exploit requires crafted user input.

  • 8.1 /10 High
    CVE-2026-103432 No auth

    apcupsd - Buffer Overflow

    apcupsd through 3.14.14 contains a stack-based buffer overflow caused by improper use of sscanf in getupsvar() in src/cgi/upsfetch.c, letting attackers cause denial of service or potentially execute code, exploit requires crafted input to vulnerable CGI scripts.

  • 8.1 /10 High
    CVE-2026-103398 Auth required

    OpenSave - Path Traversal

    OpenSave <= 2.4.0 contains a path traversal caused by improper validation of save paths in the manifest request handler, letting attackers read and write arbitrary files outside configured locations, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-103395

    LightLLM - Remote Code Execution

    LightLLM through 1.2.0 visual_only deployments contains an insecure deserialization caused by unauthenticated RPyC service with allow_pickle enabled in remote_infer_images method, letting attackers execute arbitrary code with service account privileges, exploit requires access to visual RPyC port.

  • 7.5 /10 High
    CVE-2026-103270 No auth

    LightLLM - Broken Access Control

    LightLLM through 1.2.0 contains a broken access control vulnerability caused by reinforcement learning control routes on the public HTTP API lacking authentication checks, letting unauthenticated attackers disrupt inference operations, exploit requires deployments started with --enable_rl.

  • 7.1 /10 High
    CVE-2026-103242 No auth

    RPM - Buffer Overflow

    RPM contains a heap-based buffer overflow caused by incorrect header type declaration of RPMTAG_FILESIGNATURES in crafted unsigned packages, letting attackers cause memory corruption via rpm2cpio, rpm2archive, and rpm -qlvp, exploit requires crafted untrusted package.