Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 415 of 695

  • 7.3 /10 High
    CVE-2026-85995

    Notepad++ - Remote Code Execution

    Notepad++ 8.9.7 to 8.9.8 contains a code execution vulnerability caused by improper validation of the updater's embedded certificate, letting attackers launch modified code via the updater path, exploit requires file replacement.

  • 7.1 /10 High
    CVE-2026-85740 Auth required

    LightRAG - Server Side Request Forgery

    LightRAG < 1.5.5 contains a server-side request forgery caused by improper validation of IPv4 addresses embedded in IPv6 transition wrappers in _validated_addresses, letting attackers fetch internal resources via crafted external image URLs, exploit requires document upload capability.

  • 9.1 /10 Critical
    CVE-2026-85734 No auth

    LightRAG - Authentication Bypass

    LightRAG < 1.5.5 contains a broken authentication caused by lack of rate limiting and account lockout on POST /login endpoint, letting network attackers perform brute force attacks to gain authenticated access, exploit requires network access.

  • 8.6 /10 High
    CVE-2026-85279 No auth

    Notepad++ - Buffer Overflow

    Notepad++ < 8.9.8 contains a stack buffer overflow caused by unchecked plugin-supplied GetLexerCount() results in PluginsManager::loadPluginFromPath, letting malicious plugins execute arbitrary code, exploit requires malicious or compromised plugin.

  • 10.0 /10 Critical
    CVE-2026-84412 No auth

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 7.1 /10 High
    CVE-2026-84395 No auth

    Premiere Pro - Privilege Escalation

    Premiere Pro contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.

  • 9.6 /10 Critical
    CVE-2026-84388 PoC publicNo auth

    Fortinet FortiPAM Chrome Extension - Information Disclosure

    Fortinet FortiPAM Chrome Extension 7.4 and 8.0 contain an improper restriction of rendered UI layers vulnerability, letting remote unauthenticated attackers disclose information, exploit requires no special privileges.

  • 7.8 /10 High
    CVE-2026-83963 No auth

    Substance3D - Out-of-Bounds Write

    Substance3D - Modeler contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-83962 No auth

    Substance3D Modeler - Buffer Overflow

    Substance3D Modeler contains a stack-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 9.9 /10 Critical
    CVE-2026-83660 No auth

    Adobe Campaign Classic - Privilege Escalation

    Adobe Campaign Classic contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-83603 PoC public

    Netdata - Command Injection

    Netdata < 2.10.4 contains a command injection caused by unsafe deserialization via a caller-controlled --socket_path in ndsudo helper, letting low-privileged attackers execute code as root, exploit requires fail2ban-client installed.

  • 7.5 /10 High
    CVE-2026-83599 No auth

    Netdata - Denial of Service

    Netdata < 2.11.0 contains a denial of service caused by unbounded decompressed output growth in websocket_client_decompress_message() before authentication, letting unauthenticated attackers exhaust server memory via compressed WebSocket frames.

  • 7.8 /10 High
    CVE-2026-83598 Auth required

    Netdata - Privilege Escalation

    Netdata 2.0.0 to 2.10.4 contains a privilege escalation caused by powershell.exe running as SYSTEM without -NoProfile during Windows Agent MSI repair, letting low-privileged users execute commands with SYSTEM privileges, exploit requires initiating MSI repair.

  • 7.0 /10 High
    CVE-2026-83597 Auth required

    Netdata Windows Agent - Privilege Escalation

    Netdata Windows Agent 2.0.0 to 2.10.4 contains a privilege escalation caused by launching elevated interactive processes during MSI repair, letting low-privileged local users execute commands with SYSTEM privileges, exploit requires local user to trigger repair.

  • 9.6 /10 Critical
    CVE-2026-82443 Auth required

    Adobe Campaign Classic - Privilege Escalation

    Adobe Campaign Classic contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.