Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 479 of 695

  • 7.8 /10 High
    CVE-2026-25278 Auth required

    Generic I2C - Memory Corruption

    A memory corruption vulnerability exists due to a race condition between memory allocation and data copying when processing I2C transfer requests, letting attackers cause memory corruption remotely, exploit requires crafted I2C requests.

  • 7.5 /10 High
    CVE-2026-25275 No auth

    Unknown Product - Denial of Service

    Affected product contains a denial of service caused by processing authentication frames with invalid FILS information element header lengths, letting attackers cause transient service disruption, exploit requires crafted authentication frames.

  • 7.4 /10 High
    CVE-2026-24081

    Bluetooth - Denial of Service

    A Bluetooth implementation contains a denial of service caused by processing a channel map with insufficient used channels when adaptive frequency hopping is fully enabled, letting attackers cause transient service disruption, exploit requires adaptive frequency hopping enabled.

  • 7.8 /10 High
    CVE-2026-24075

    Device Control Handler - Race Condition

    A device control handler contains a memory corruption vulnerability caused by improper synchronization and race conditions when multiple threads issue concurrent IOCTL requests, letting attackers cause memory corruption, exploit requires concurrent IOCTL requests.

  • 7.8 /10 High
    CVE-2026-24074

    CVE-2026-24074

    Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.

  • 7.8 /10 High
    CVE-2026-24073

    Unknown - Memory Corruption

    Unknown product contains a memory corruption vulnerability caused by insufficient validation of offset against structure size during decode statistics processing, letting attackers cause memory corruption, exploit requires unspecified conditions.

  • 7.8 /10 High
    CVE-2026-19477 No auth

    MCC Universal Library for Linux (uldaq) - Buffer Overflow

    MCC Universal Library for Linux (uldaq) <= 1.2.1 contains a stack-based buffer overflow caused by improper bounds checking, letting attackers execute arbitrary code or disclose information, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-15815 No auth

    Grafana OSS & Enterprise - Remote Code Execution

    Grafana OSS and Grafana Enterprise contain a remote code execution vulnerability caused by unsafe resolution of symbolic links during plugin archive extraction, letting attackers write and execute arbitrary files outside the plugin directory, exploit requires installation of a crafted plugin archive.

  • 9.2 /10 Critical
    CVE-2026-15688 Auth required

    Mitsubishi Electric GX Works3 & Motion Control Setting - Authentication Bypass

    Mitsubishi Electric GX Works3 and Motion Control Setting contain an authentication bypass caused by incorrect implementation of the authentication algorithm, letting local attackers authenticate with invalid passwords and manipulate control programs, exploit requires local access and executable modification.

  • 7.8 /10 High
    CVE-2025-59607

    CVE-2025-59607

    Memory Corruption when copying large input data exceeds normal allocation limits.

  • 9.8 /10 Critical
    CVE-2025-55787 No auth

    MailData Email Archiving System - SQL Injection

    MailData Email Archiving System <= 4.2 contains a sql injection caused by unsanitized input in database queries, letting attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2025-15697 No auth

    Dictionary WordPress plugin - Reflected XSS

    Dictionary WordPress plugin through 1.0 contains a reflected XSS caused by unescaped user input in several scripts, letting unauthenticated attackers execute scripts via crafted requests.

  • 7.8 /10 High
    CVE-2026-92816 No auth

    ComfyUI - Path Traversal & Remote Code Execution

    ComfyUI < 0.30.0 contains a path traversal caused by unsanitized folder_name input in dataset save nodes, letting attackers write files to arbitrary paths and execute code via modified startup files, exploit requires loading a crafted workflow.

  • 7.5 /10 High
    CVE-2026-92815 No auth

    changedetection.io - Server Side Request Forgery

    changedetection.io <= 0.60.6 contains a server-side request forgery caused by failure to validate the Goto URL action in browser steps, letting unauthenticated attackers access internal network addresses via arbitrary URLs in the optional_value parameter.

  • 8.1 /10 High
    CVE-2026-92806 No auth

    phpList - Cross-Site Request Forgery

    phpList < 3.6.17 contains a cross-site request forgery vulnerability caused by failure to validate CSRF tokens in the mass subscriber removal form handler, letting attackers induce logged-in administrators to delete and blacklist subscribers silently.