Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 484 of 681

  • 7.5 /10 High
    CVE-2026-81736 No auth

    BIND 9 - Denial of Service

    BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1 contain a denial of service caused by excessive CPU consumption when resolving cached SVCB/HTTPS AliasMode record trees, letting remote attackers cause resource exhaustion, exploit requires crafted DNS queries.

  • 9.8 /10 Critical
    CVE-2026-81642 PoC publicNo auth

    NLnet Labs Unbound - Buffer Overflow

    NLnet Labs Unbound <= 1.26.0 contains a buffer overflow in DNSSEC validator caused by a DNSKEY with an owner compression pointer to its own RDATA, letting remote attackers cause denial of service or remote code execution, exploit requires attacker-controlled malicious zone.

  • 7.5 /10 High
    CVE-2026-81634

    NLnet Labs Unbound - Buffer Overflow

    NLnet Labs Unbound <= 1.26.0 contains a heap buffer overflow caused by missing buffer length check for the first owner name during RRSet canonicalisation, letting malicious name servers or tampered responses cause memory corruption, exploit requires attacker to control or tamper DNS responses.

  • 7.5 /10 High
    CVE-2026-81563 No auth

    BIND 9 - Denial of Service

    BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1 contain a denial of service caused by improper deallocation of internal resources when processing SVCB/HTTPS AliasMode records referencing 14 or more ServiceMode records, letting attackers exhaust resolver resources, exploit requires repeated triggering of the condition.

  • 7.5 /10 High
    CVE-2026-80274 No auth

    BIND 9 - Denial of Service

    BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25 contain a denial of service caused by unexpected handling of DNSSEC wildcard and NSEC responses, letting remote attackers cause program exit, exploit requires crafted DNS responses.

  • 7.5 /10 High
    CVE-2026-79993 No auth

    Apache ZooKeeper - Authorization Bypass

    Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 contain an authorization bypass caused by the deleteContainer opcode (0x14) processing without ACL verification, letting authenticated clients delete specific znodes regardless of ACL restrictions, exploit requires ability to open a plain TCP session on the client port.

  • 8.5 /10 High
    CVE-2026-79708 Auth required

    GitLab EE - Broken Access Control

    GitLab EE >= 19.0, < 19.1.8, >= 19.2, < 19.2.6, and >= 19.3, < 19.3.2 contains an access control vulnerability caused by insufficient scope validation in policy test pipeline execution, letting authenticated users with developer permissions access protected CI/CD variables, exploit requires developer permissions.

  • 7.5 /10 High
    CVE-2026-79651 No auth

    Keycloak keycloak-services - Denial of Service

    Keycloak keycloak-services contains a denial of service caused by unrestricted caching of arbitrary locale tags from unauthenticated requests in theme localization endpoints, letting attackers crash the server by exhausting memory, exploit requires no authentication.

  • 8.4 /10 High
    CVE-2026-79298 PoC publicNo auth

    Howyar Technologies Inc SysReturn - Remote Code Execution

    Howyar Technologies Inc SysReturn < 11.3.034 contains a local code execution vulnerability caused by crafted cloak32.dat file on the ESP affecting BOOTia32.efi, letting local attackers execute arbitrary code.

  • 8.6 /10 High
    CVE-2026-78472 No auth

    Ni WooCommerce Sales Report - SQL Injection

    Ni WooCommerce Sales Report WordPress plugin < 4.2.0 contains a SQL injection caused by unsanitized and unescaped parameter usage in SQL statements, letting unauthenticated attackers execute arbitrary SQL commands remotely.

  • 8.2 /10 High
    CVE-2026-78252 No auth

    GitLab CE/EE - Cross Site Request Forgery

    GitLab CE/EE >= 15.3 and < 19.1.8, 19.2 and < 19.2.6, 19.3 and < 19.3.2 contain a cross site request forgery caused by improper sanitization of user-controlled data in the Markdown JSON table renderer, letting authenticated attackers induce targeted users to perform unintended state-changing HTTP requests, exploit requires user interaction.

  • 8.8 /10 High
    CVE-2026-78088 Auth required

    The Contest Gallery WordPress - Arbitrary File Overwrite

    The Contest Gallery WordPress plugin <= 32.0.1 contains an arbitrary file overwrite vulnerability caused by insufficient file path validation in the 'baseUrlForFacebook' parameter, letting authenticated subscribers overwrite files potentially leading to remote code execution, exploit requires subscriber-level access or higher.

  • 7.5 /10 High
    CVE-2026-77692 No auth

    BIND 9 - Denial of Service

    BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1 contain a denial of service caused by processing a crafted DNS-over-HTTPS request with an invalid SIG(0) record and premature connection closure, letting attackers crash the named service, exploit requires sending crafted DNS-over-HTTPS requests.

  • 8.4 /10 High
    CVE-2026-76825

    RestrictedPython - Sandbox Escape

    RestrictedPython < 8.4 contains a sandbox escape caused by unsafe attribute and item traversal in string.Formatter methods, letting restricted code execute arbitrary code and access sensitive resources, exploit requires exposure of string module or Formatter objects.

  • 7.5 /10 High
    CVE-2026-76646 No auth

    Unknown - Denial of Service

    Unknown product contains a denial of service caused by excessive resource consumption from specially crafted request parameters, letting remote attackers cause service disruption, exploit requires no special privileges.