Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 423 of 695

  • 7.5 /10 High
    CVE-2026-43643 No auth

    Softaculous Virtualizor - Authorization Bypass

    Softaculous Virtualizor < 3.2.9 (Patch 9) and 3.0.0 contain an authorization bypass caused by improper validation in the billing module handler, letting unauthenticated remote attackers modify tenant account balances via crafted parameters.

  • 8.1 /10 High
    CVE-2026-43642 No auth

    Softaculous Virtualizor - Remote Code Execution

    Softaculous Virtualizor < 3.2.9 (Patch 9) and 3.0.0 contain a PHP object injection caused by unsafe unserialize() usage in the billing module handler, letting unauthenticated remote attackers achieve remote code execution as root, exploit requires crafted POST request with specific parameters.

  • 9.8 /10 Critical
    CVE-2026-43641 No auth

    Softaculous Virtualizor - OS Command Injection

    Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection caused by deserialization of crafted billing_data POST field in the billing module handler, letting unauthenticated remote attackers execute arbitrary commands as root, exploit requires specific parameter combinations to bypass authentication.

  • 8.6 /10 High
    CVE-2026-34689 No auth

    Adobe Connect - Path Traversal

    Adobe Connect contains a path traversal caused by improper limitation of pathname to restricted directory, letting attackers read arbitrary files outside intended scope, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-28325 No auth

    SolarWinds Observability Self-Hosted - Remote Code Execution

    SolarWinds Observability Self-Hosted contains an insecure deserialization vulnerability caused by deserialization of untrusted data in a specific communication mode, letting unauthenticated remote attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-28324

    SolarWinds Observability Self-Hosted - Remote Code Execution

    SolarWinds Observability Self-Hosted contains a remote code execution vulnerability caused by insufficient integrity checks in non-default, non-secure configurations, letting unauthenticated attackers execute code remotely, exploit requires non-default insecure configuration.

  • 8.8 /10 High
    CVE-2026-25265

    Unknown - Privilege Escalation

    Unknown product contains a privilege escalation caused by weak configuration in temporary file handling, letting attackers escalate privileges, exploit requires specific weak configuration.

  • 8.8 /10 High
    CVE-2026-25264

    Unknown - Privilege Escalation

    Unknown vendor and product contain a privilege escalation caused by weak configuration during package extraction process, letting attackers escalate privileges, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-25255

    Unknown Product - Privilege Escalation

    An unspecified product contains a privilege escalation vulnerability caused by exposed dangerous function in gRPC server, letting attackers escalate privileges, exploit requires unspecified conditions.

  • 9.8 /10 Critical
    CVE-2026-25254 No auth

    Unspecified Product - Remote Code Execution

    An unspecified product contains a remote code execution caused by improper authorization in the SocketIO interface, letting attackers execute arbitrary code remotely, exploit requires no special conditions.

  • 7.8 /10 High
    CVE-2026-24267 No auth

    NVIDIA NeMo Speech - Remote Code Execution

    NVIDIA NeMo Speech contains a remote code execution vulnerability caused by malicious data in the speech data explorer component, letting remote attackers execute code and escalate privileges, exploit requires crafted malicious data.

  • 7.8 /10 High
    CVE-2026-24239 No auth

    NVIDIA NeMo Speech - Remote Code Execution

    NVIDIA NeMo Speech contains a remote code execution vulnerability caused by processing malicious data, letting remote attackers execute code, disclose information, and tamper data, exploit requires crafted malicious input.

  • 9.8 /10 Critical
    CVE-2026-19658 PoC public

    GiveWP Give Tributes - Insecure Deserialization

    GiveWP Give Tributes plugin for WordPress <= 2.3.1 contains a PHP Object Injection caused by deserialization of untrusted input when 'Allow Multiple Recipients' is enabled and 'Custom Message' is disabled, letting unauthenticated attackers inject PHP objects, exploit requires specific plugin settings and presence of a POP chain in other plugins or themes.

  • 7.5 /10 High
    CVE-2026-19480 No auth

    CAI Content Credentials - Security Feature Bypass

    CAI Content Credentials contains an improper input validation vulnerability that allows attackers to bypass security features and gain unauthorized write access, exploit requires no user interaction.

  • 7.4 /10 High
    CVE-2026-18176 No auth

    IBM Financial Transaction Manager - Information Disclosure

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an information disclosure vulnerability caused by cleartext transmission of sensitive information, letting remote attackers obtain sensitive data, exploit requires network access.