Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 449 of 695

  • 8.6 /10 High
    CVE-2026-68928 No auth

    Acode - Command Injection

    Acode 1.11.6 to 1.12.7 contains a command injection caused by an exported TerminalService without binding permission and lack of caller verification, letting local attackers execute commands with Acode's privileges, exploit requires local app installation.

  • 7.6 /10 High
    CVE-2026-67549 PoC publicNo auth

    OpenImageIO - Buffer Overflow

    OpenImageIO < 3.1.16.0 contains a heap out-of-bounds write caused by improper bit conversion in TIFFInput::read_native_scanline_locked() when processing crafted 1-bit contiguous CMYK TIFF images, letting attackers cause memory corruption, exploit requires crafted TIFF file.

  • 7.6 /10 High
    CVE-2026-67103 Auth required

    HCL BigFix Service Management - Stored XSS

    HCL BigFix Service Management contains a stored XSS vulnerability caused by unsanitized script injection, letting attackers execute malicious scripts in victim browsers, exploit requires victim interaction.

  • 8.1 /10 High
    CVE-2026-67102 Auth required

    HCL BigFix Service Management - Broken Access Control

    HCL BigFix Service Management contains a broken access control vulnerability caused by insufficient privilege checks, letting low-privileged users access administrative screens and functions, exploit requires low-privileged user access.

  • 9.3 /10 Critical
    CVE-2026-67101 No auth

    HCL BigFix Service Management - Server-Side Request Forgery

    HCL BigFix Service Management contains a server-side request forgery caused by improper validation in search functionality, letting attackers force the server to send requests to internal systems, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-67100 No auth

    HCL BigFix Service Management - SQL Injection & Broken Access Control

    HCL BigFix Service Management contains an SQL Injection and Cross-Tenant Data Exposure caused by improper input validation and request handling, letting authenticated attackers extract sensitive data and access personal profiles across tenants, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-63638 PoC publicNo auth

    OpenImageIO - Out of Bounds Read/Write

    OpenImageIO < 3.0.21.0, < 3.1.16.0, and < 3.2.0.3-beta1 contain a heap out-of-bounds write caused by improper bit depth handling in cineoninput::read_native_scanline, letting attackers cause memory corruption remotely, exploit requires crafted cineon image.

  • 7.5 /10 High
    CVE-2026-63452 No auth

    Suricata - Denial of Service

    Suricata 8.0.0 to 8.0.6 contains a denial of service caused by unbounded processing of multiple small Brotli compression bombs in HTTP/1 parser, letting attackers degrade packet processing, exploit requires sending repeated compressed responses in a single flow.

  • 7.5 /10 High
    CVE-2026-63447 No auth

    Suricata - Denial of Service

    Suricata 8.0.5 to 8.0.6 contains a denial of service caused by continued allocation of FTP transactions beyond max-tx limit in the FTP parser, letting attackers degrade packet processing, exploit requires crafted FTP traffic.

  • 7.5 /10 High
    CVE-2026-63446 No auth

    Suricata - Denial of Service

    Suricata 8.0.0 to 8.0.6 contains a denial of service caused by improper transaction inspection marking in AppLayerParserSetTransactionInspectId, letting attackers cause CPU and memory exhaustion by triggering repeated rescans, exploit requires network traffic triggering pass rules.

  • 7.8 /10 High
    CVE-2026-63422 PoC publicNo auth

    OpenImageIO - Out of Bounds Read/Write

    OpenImageIO < 3.0.21.0, < 3.1.16.0, and < 3.2.0.3-beta1 contain a heap out-of-bounds write caused by incorrect handling of partial edge-tile rectangles in OpenEXRInput::read_native_tiles(), letting attackers cause memory corruption remotely, exploit requires crafted tiled openexr image with width not multiple of tile width.

  • 7.8 /10 High
    CVE-2026-63419 PoC publicNo auth

    OpenImageIO - Buffer Overflow

    OpenImageIO < 3.0.21.0, < 3.1.16.0, and < 3.2.0.3-beta1 contain a heap out-of-bounds write caused by incorrect buffer size handling in iffinput::read_native_tile(), letting attackers cause memory corruption remotely, exploit requires crafted image files.

  • 10.0 /10 Critical
    CVE-2026-62874 No auth

    Azure Billing - Broken Access Control

    Azure Billing contains a broken access control vulnerability caused by insufficient verification of data authenticity, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-62279 Auth required

    LubeLogger - Broken Access Control

    LubeLogger < 1.6.8 contains a broken access control vulnerability caused by missing authorization checks on source vehicle records in DuplicateRecordsToOtherVehicles endpoint, letting authenticated users copy records from other users, exploit requires authentication.

  • 8.1 /10 High
    CVE-2026-62278 Auth required

    LubeLogger - Path Traversal

    LubeLogger < 1.6.8 contains a path traversal caused by improper validation of uploaded file paths in HandleTranslationFileUpload, letting authenticated non-admin users place or overwrite files outside intended directories.