Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 448 of 695

  • 8.8 /10 High
    CVE-2026-77929 Auth required

    ClipBucket - Remote Code Execution

    ClipBucket v5 < 5.5.3-#182 contains a remote code execution caused by improper file extension update after MIME validation in FileUpload::manageFile(), letting authenticated users execute PHP code via photo upload endpoint.

  • 7.5 /10 High
    CVE-2026-77301 No auth

    adm-zip - Denial of Service

    adm-zip < 0.6.1 contains a denial of service caused by trusting uncompressed size in central-directory leading to excessive memory allocation in getData(), letting attackers exhaust memory via crafted ZIP archives, exploit requires processing untrusted ZIP files.

  • 9.9 /10 Critical
    CVE-2026-77240 Auth required

    WACRM - Broken Access Control & Information Disclosure

    WACRM <= 0.7.0 contains broken access control caused by improper row-level security policies and SECURITY DEFINER functions, letting authenticated users escalate privileges or access other tenants' data, exploit requires authentication.

  • 8.1 /10 High
    CVE-2026-77239 Auth required

    WACRM - Broken Access Control

    WACRM <= 0.7.0 contains a broken access control vulnerability caused by missing agent role enforcement in flow and automation write routes, letting authenticated account viewers modify workflows and trigger actions, exploit requires authenticated viewer role.

  • 7.5 /10 High
    CVE-2026-75895 No auth

    libsmpp35 - Out of Bounds Read

    libsmpp35 0.1.0 through 1.8.0 contains an out of bounds read caused by improper handling of attacker-controlled SMPP PDUs in smpp34_unpack() function, letting attackers cause memory corruption, exploit requires crafted SMPP PDUs.

  • 7.5 /10 High
    CVE-2026-75894 No auth

    osmo-iuh - Denial of Service

    osmo-iuh 0.1.0 through 1.8.0 contains a denial of service caused by a reachable assertion failure in the ranap_handle_co_dt() function via an arbitrarily sized NAS-PDU, letting remote attackers crash the process, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-75893 No auth

    osmo-bsc - Buffer Overflow

    osmo-bsc 1.0.1 through 1.14.1 contains a buffer overflow caused by improper handling of IPA frame lengths in ipaccess_proxy_read_msg() function, letting attackers cause memory corruption, exploit requires crafted IPA frames.

  • 9.3 /10 Critical
    CVE-2026-75885 No auth

    OpenShift Console - Server-Side Request Forgery & Denial of Service

    OpenShift console contains a server-side request forgery and denial of service caused by unauthenticated access to /api/devfile/ endpoints allowing crafted payloads and large repeated requests, letting remote attackers cause SSRF and DoS, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-75878 No auth

    IBM Sterling File Gateway - Authentication Bypass

    IBM Sterling File Gateway contains an authentication bypass caused by improper validation of SSO header, letting remote attackers obtain fully authenticated sessions, exploit requires crafted SSO header.

  • 7.5 /10 High
    CVE-2026-75157 PoC publicNo auth

    Apache Airflow - Broken Access Control

    Apache Airflow contains a broken access control vulnerability caused by checking DAG permission with READ instead of EDIT on asset queued-events DELETE endpoints, letting authenticated users delete queued asset events, exploit requires authenticated user with DAG read access.

  • 9.8 /10 Critical
    CVE-2026-75031

    Interchange - Remote Code Execution

    Interchange contains a remote code execution caused by arbitrary Perl code injection in the "quick question" admin feature, letting unauthenticated attackers execute code server-side, exploit requires AllowGlobal directive enabled.

  • 7.5 /10 High
    CVE-2026-71418 No auth

    Suricata - Denial of Service

    Suricata 8.0.0 to 8.0.6 contains a denial of service caused by improper clearing of internal buffer in DNS-over-HTTP/2 processing in rust/src/http2/http2.rs, letting attackers cause CPU overload and packet loss, exploit requires sending multiple HTTP/2 DATA frames with EndOfStream flag.

  • 7.3 /10 High
    CVE-2026-7006 Auth required

    Sublime Text - Privilege Escalation

    Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation caused by abuse of the update staging mechanism allowing malicious DLL placement, letting unprivileged local attackers execute code with elevated privileges, exploit requires local access.

  • 10.0 /10 Critical
    CVE-2026-69843 No auth

    Microsoft Fabric - Authentication Bypass

    Microsoft Fabric contains an authentication bypass caused by spoofing, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-69184 No auth

    c-ares - Denial of Service

    c-ares < 1.34.7 contains a denial of service caused by unbounded DNS compression pointer hops in ares_dns_name_parse(), letting malicious DNS servers stall the event loop, exploit requires crafted DNS response.