Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 421 of 695
- 7.8 /10 HighCVE-2026-75658 No auth
Bridge - Remote Code Execution
Bridge contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 7.8 /10 HighCVE-2026-75655 No auth
Bridge - Remote Code Execution
Bridge contains an uncontrolled recursion vulnerability that could result in arbitrary code execution in the context of the current user, letting attackers execute arbitrary code, exploit requires victim to open a malicious file.
- 7.8 /10 HighCVE-2026-75649 No auth
Bridge - Remote Code Execution
Bridge contains a heap-based buffer overflow caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 7.5 /10 HighCVE-2026-75632 No auth
CAI Content Credentials - Denial of Service
CAI Content Credentials contains an uncontrolled resource consumption vulnerability caused by improper resource management, letting attackers cause application denial-of-service, exploit requires no user interaction.
- 7.7 /10 HighCVE-2026-75608 Auth required
Frigate - Broken Access Control
Frigate < 0.18.0 contains a broken access control caused by insufficient role verification on /api/go2rtc/api GET requests, letting authenticated viewer users access sensitive internal data, exploit requires viewer authentication.
- 8.1 /10 HighCVE-2026-75607 Auth required
Frigate - Broken Access Control
Frigate < 0.17.2 contains a broken access control vulnerability caused by lack of role-aware authorization in the WebSocket handler, letting authenticated viewers send admin-only commands, exploit requires valid viewer credentials.
- 9.8 /10 CriticalCVE-2026-74849 No auth
Zohocorp ManageEngine ADSelfService Plus - Remote Code Execution
Zohocorp ManageEngine ADSelfService Plus < 7001 contains a remote code execution vulnerability caused by an issue in the GINA client, letting remote attackers execute arbitrary code, exploit requires network access.
- 8.4 /10 HighCVE-2026-74766 No auth
Net::IDN::Punycode - Use After Free
Net::IDN::Punycode 2.301 before 2.590 for Perl contains a use-after-free caused by improper buffer reallocation in decode_punycode, letting attackers read and write freed heap memory during punycode decoding, exploit requires attacker-supplied input.
- 10.0 /10 CriticalCVE-2026-73369 No auth
Adobe Campaign Classic - Code Injection
Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 8.8 /10 HighCVE-2026-70410 Auth required
Apache Calcite Avatica - Unsafe Reflection
Apache Calcite Avatica < 1.29.0 contains an unsafe reflection vulnerability caused by unrestricted calls to Class.forName(String) in plugin instantiation, letting attackers execute static initializers in arbitrary classes, exploit requires attacker to control class name input.
- 7.1 /10 HighCVE-2026-6922 Auth required
WP Table Builder - Broken Access Control
WP Table Builder – Drag & Drop Table Builder plugin for WordPress <= 2.2.1 contains an incorrect authorization caused by an operator precedence bug and insufficient permission checks in trash_table_bulk() and restore_table_bulk(), letting authenticated attackers with subscriber-level access trash or restore any post, exploit requires subscriber-level authentication.
- 8.8 /10 HighCVE-2026-67615 Auth required
openEQUELLA - Remote Code Execution
openEQUELLA < 2026.1.0 contains an authenticated remote code execution caused by Java deserialization bypassing class-name denylist in /invoker/* endpoint, letting authenticated non-guest users execute arbitrary code.
- 8.8 /10 HighCVE-2026-65179
NVIDIA NeMo - Insecure Deserialization
NVIDIA NeMo contains an insecure deserialization vulnerability caused by untrusted .pkl file deserialization in TabularTokenizer class, letting attackers execute code, tamper data, cause denial of service, and disclose information, exploit requires attacker-controlled .pkl file.
- 7.8 /10 HighCVE-2026-65178 Auth required
NVIDIA NeMo - Code Injection
NVIDIA NeMo contains a code injection vulnerability caused by unsafe parameter injection via a maliciously crafted model_config.yaml in the dataset-loading workflow, letting attackers execute code, tamper data, cause denial of service, and disclose information, exploit requires crafted model_config.yaml.
- 8.0 /10 HighCVE-2026-65130 Auth required
NVIDIA Infrastructure Controller for Linux - Command Injection
NVIDIA Infrastructure Controller for Linux contains a command injection vulnerability caused by improper input handling, letting attackers execute arbitrary OS commands, potentially leading to code execution, data tampering, denial of service, and information disclosure, exploit requires crafted input.