Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 4 of 891

  • 8.7 /10 High
    CVE-2026-71450 Auth required

    Johnson Controls EasyIO Neo EC and CW Edge Controller - Authentication Bypass

    Johnson Controls EasyIO Neo EC and CW Edge Controller from EC 3.3b62 through EC 3.3b63 and CW 3.3b24 through CW 3.3b25 contain an authentication bypass caused by use of alternate path or channel, letting attackers bypass authentication, exploit requires no special privileges.

  • 8.4 /10 High
    CVE-2026-59044 No auth

    Software - Use After Free

    Software contains a use-after-free caused by a logic error in multiple locations, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-59028 No auth

    RegisteredAidCache - Broken Access Control

    RegisteredAidCache contains a permission bypass caused by a confused deputy issue in resolveAidConflictLocked, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-59000 No auth

    Multiple Locations - Broken Access Control

    Multiple locations contain a permission bypass caused by confused deputy issue, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58984 No auth

    Unknown - Use After Free

    Unknown product contains a use-after-free vulnerability caused by memory corruption in multiple locations, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58970 No auth

    AppTimeTracker - Privilege Escalation

    AppTimeTracker contains a local privilege escalation caused by a confused deputy in deliverResult method, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58965 No auth

    MusicFxHelper - Privilege Escalation

    MusicFxHelper in handleAudioEffectBroadcast contains a permission bypass caused by a confused deputy issue, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58957 No auth

    Android ActivityStarter - Privilege Escalation

    Android ActivityStarter contains a privilege escalation caused by confused deputy in resolveToHeavyWeightSwitcherIfNeeded, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58946 No auth

    Android ActivityClientController - Broken Access Control

    Android ActivityClientController contains a permission bypass caused by a logic error in navigateUpTo, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58944 No auth

    Android ActivityTaskManagerService - Privilege Escalation

    Android ActivityTaskManagerService contains a local privilege escalation caused by a confused deputy issue in moveTaskToFrontLocked, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58943 No auth

    AddAccountSettings.java - Privilege Escalation

    AddAccountSettings.java contains a confused deputy vulnerability causing background activity launch, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58942 No auth

    Memory - Use After Free

    Memory component contains a use after free caused by a logic error in do_fault_around, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58934 No auth

    WindowState - Permission Bypass

    WindowState.java contains a permission bypass caused by a logic error in prepareWindowToDisplayDuringRelayout, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58885 No auth

    Multiple Products - Broken Access Control

    Multiple locations contain a permission bypass caused by a confused deputy issue, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-58884 No auth

    WifiServiceImpl - Broken Access Control

    WifiServiceImpl contains a permission bypass caused by a confused deputy in startTetheredHotspotRequest, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.