Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 44 of 677

  • 9.8 /10 Critical
    CVE-2020-37282 No auth

    office-converter - Command Injection

    office-converter through 1.0.2 contains a command injection caused by unsanitized fileName input in generatePdf() or generateHtml(), letting attackers execute OS commands with Node.js process privileges, exploit requires crafted fileName input.

  • 8.1 /10 High
    CVE-2020-37281 No auth

    Gravitee API Management - Authentication Bypass

    Gravitee API Management through 4.12.22 contains an authentication bypass caused by forged JWTs signed with the default jwt.secret, letting unauthenticated remote attackers impersonate any user, exploit requires knowledge of a valid user ID.

  • 7.8 /10 High
    CVE-2017-20286 No auth

    DevIL - Remote Code Execution

    DevIL through 1.8.0 contains a heap-based buffer overflow caused by improper handling of two-frame GIF images with disposal method 1 and local colour table in iGetPalette() in il_gif.cpp, letting attackers execute arbitrary code remotely, exploit requires crafted GIF image.

  • 8.3 /10 High
    CVE-2016-15060 No auth

    PCMan FTP Server - Buffer Overflow

    PCMan FTP Server <= 2.0.7 contains a buffer overflow caused by improper handling in the PORT Command Handler, letting remote attackers cause memory corruption, exploit requires crafted network request.

  • 7.5 /10 High
    CVE-2026-97830 No auth

    Windows Internet Information Services - Denial of Service

    Windows Internet Information Services contains a double free vulnerability caused by improper memory management, letting unauthorized attackers cause denial of service remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-97816 No auth

    OpenSSH for Windows - Remote Code Execution

    OpenSSH for Windows contains a use after free vulnerability that allows unauthorized attackers to execute code over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-97815 No auth

    Windows Error Reporting - Remote Code Execution

    Windows Error Reporting contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-97814 No auth

    Windows Text Shaping - Remote Code Execution

    Windows Text Shaping contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 7.0 /10 High
    CVE-2026-97812 Auth required

    Windows Update Orchestrator Service - Privilege Escalation

    Windows Update Orchestrator Service contains a double free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory management flaws.

  • 7.8 /10 High
    CVE-2026-97811 Auth required

    OpenSSH for Windows - Privilege Escalation

    OpenSSH for Windows contains a double free vulnerability in its code, letting authorized local attackers elevate privileges, exploit requires local access with authorization.

  • 7.0 /10 High
    CVE-2026-97810 Auth required

    Windows Container Isolation FS Filter Driver - Privilege Escalation

    Windows Container Isolation FS Filter Driver (unionfs.sys) contains a heap-based buffer overflow, letting authorized local attackers elevate privileges, exploit requires local access with authorization.

  • 7.8 /10 High
    CVE-2026-97809 Auth required

    Windows Broadcast DVR User Service - Privilege Escalation

    Windows Broadcast DVR User Service contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory corruption.

  • 7.0 /10 High
    CVE-2026-97808 Auth required

    Windows Broadcast DVR User Service - Privilege Escalation

    Windows Broadcast DVR User Service contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory corruption.

  • 7.8 /10 High
    CVE-2026-97807 Auth required

    Windows Broadcast DVR User Service - Privilege Escalation

    Windows Broadcast DVR User Service contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory corruption.

  • 7.8 /10 High
    CVE-2026-97806 Auth required

    Windows Broadcast DVR User Service - Privilege Escalation

    Windows Broadcast DVR User Service contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory corruption.