Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 478 of 695

  • 9.0 /10 Critical
    CVE-2026-47252 Auth required

    Anyquery - Command Injection

    Anyquery prior to 0.4.5 contains a command injection caused by improper sanitization of SQL-controlled URLs in macOS virtual tables, letting authenticated users with INSERT or UPDATE access execute arbitrary OS commands, exploit requires authenticated user with specific write permissions.

  • 7.6 /10 High
    CVE-2026-45726 Auth required

    Omni - Broken Access Control

    Omni 1.3.0 to 1.6.6 and 1.7.3 contains an information disclosure caused by improper access control on ImportedClusterSecrets resource, letting authenticated users with Reader role access CA private keys, exploit requires unrotated secrets.

  • 7.0 /10 High
    CVE-2026-45720

    Omni - Authentication Bypass

    Omni < 1.6.6 and 1.7.0 < 1.7.3 contains a broken authentication caused by race condition in SAML.getSession allowing concurrent reuse of SAML assertions, letting attackers authenticate as victims and create persistent credentials, exploit requires concurrent requests with same SAML token.

  • 9.0 /10 Critical
    CVE-2026-45143 Auth required

    Chamilo LMS - Stored XSS

    Chamilo LMS 2.0.0 through 2.1.0 contains a stored XSS vulnerability caused by lack of server-side sanitization of private message content, letting authenticated low-privilege users execute scripts in administrator browsers, exploit requires authenticated user sending crafted message.

  • 9.8 /10 Critical
    CVE-2026-45140 PoC publicNo auth

    Chamilo LMS - Remote Code Execution

    Chamilo LMS < 2.0.1 contains a remote code execution vulnerability caused by an unspecified issue, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no special conditions.

  • 7.1 /10 High
    CVE-2026-44236

    rabbitmq-c - Buffer Overflow

    rabbitmq-c < 0.16.0 contains a buffer overflow caused by accepting undersized connection.tune.frame_max value during amqp_login(), letting malicious AMQP servers cause memory corruption and denial of service, exploit requires malicious AMQP server.

  • 8.8 /10 High
    CVE-2026-28326 PoC publicNo auth

    SolarWinds Access Rights Manager - Remote Code Execution

    SolarWinds Access Rights Manager contains an unauthenticated remote code execution caused by a hardcoded static key, letting remote attackers execute arbitrary code without authentication.

  • 8.1 /10 High
    CVE-2026-26950 Auth required

    Dell SmartFabric Manager - Privilege Escalation

    Dell SmartFabric Manager < 2.2.1 contains an insufficient verification of data authenticity vulnerability, letting low privileged remote attackers elevate their privileges, exploit requires remote access.

  • 7.4 /10 High
    CVE-2026-25294

    CVE-2026-25294

    Transient DOS while parsing frame during channel usage.

  • 7.8 /10 High
    CVE-2026-25290 Auth required

    Unknown - Memory Corruption

    Unknown product contains a memory corruption vulnerability caused by improper validation of large data buffers using addition to check buffer length, letting attackers cause memory corruption, exploit requires crafted large data buffers.

  • 7.3 /10 High
    CVE-2026-25284

    undefined - Information Disclosure

    undefined contains an information disclosure caused by use-after-free of a pointer, letting attackers disclose sensitive information, exploit requires undefined conditions.

  • 8.8 /10 High
    CVE-2026-25283

    CVE-2026-25283

    Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.

  • 7.9 /10 High
    CVE-2026-25282 Auth required

    Generic Product - Denial of Service

    A product contains a denial of service caused by out of bound memory access when processing unverified data from a neighboring system, letting attackers cause transient denial of service, exploit requires network access.

  • 7.4 /10 High
    CVE-2026-25281 No auth

    Generic Software - Denial of Service

    Affected software contains a denial of service caused by insufficient memory allocation validation when processing large or numerous request buffers, letting attackers cause transient denial of service, exploit requires crafted requests.

  • 7.8 /10 High
    CVE-2026-25280

    CVE-2026-25280

    Memory corruption when processing escape handling flow with insufficient user buffer sizes.