Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 486 of 681

  • 7.1 /10 High
    CVE-2026-74926 Auth required

    MultiVendorX WordPress Plugin - Broken Access Control

    MultiVendorX WordPress plugin < 5.0.16 contains a broken access control vulnerability caused by lack of ownership verification in a REST API route, letting any authenticated user overwrite store details and ownership.

  • 8.1 /10 High
    CVE-2026-74909 Auth required

    Keycloak - Broken Access Control

    Keycloak contains a broken access control caused by improper normalization of encoded special characters in web addresses, letting authenticated users bypass security policies and gain unauthorized access to sensitive endpoints, exploit requires user authentication.

  • 8.8 /10 High
    CVE-2026-73464 Auth required

    Arista EOS - Remote Code Execution

    Arista EOS with gRPC Network Management Interface (gNMI) enabled contains a remote code execution caused by specially crafted requests, letting authenticated gNMI clients execute arbitrary code with root privileges on the switch, exploit requires authenticated gNMI access.

  • 8.0 /10 High
    CVE-2026-73461 Auth required

    EOS - Authorization Bypass

    EOS platforms with AAA-based gRPC authorization enabled contain an authorization bypass caused by incorrect privilege level assignment in gRPC OpenConfig requests, letting authenticated users gain incorrect authorization, exploit requires authenticated user.

  • 7.4 /10 High
    CVE-2026-73459

    Arista EOS - Denial of Service

    Arista EOS with IS-IS configured contains a denial of service caused by injection of specially crafted IS-IS LSP PDU, letting unauthenticated attackers cause legitimate LSP purging and traffic loss, exploit requires ability to inject IS-IS LSP PDU.

  • 10.0 /10 Critical
    CVE-2026-73456

    Arista EOS - Remote Code Execution

    Arista EOS contains a remote code execution caused by crafted malicious requests in gRPC Network Packet Sampling Interface (gNPSI), letting unauthenticated attackers gain full administrative control, exploit requires gNPSI enabled.

  • 7.5 /10 High
    CVE-2026-73455 No auth

    Arista EOS - Denial of Service

    Arista EOS with Open Shortest Path First version 3 (OSPFv3) contains a denial of service caused by specially crafted packets triggering unexpected OSPFv3 agent restarts, letting remote attackers cause service disruption, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-73454

    Arista EOS - Broken Access Control

    Arista EOS with gRPC Network Security Interface (gNSI) Credentialz contains a broken access control vulnerability caused by specially crafted requests modifying account properties, letting attackers escalate privileges, exploit requires gNSI Credentialz configured.

  • 10.0 /10 Critical
    CVE-2026-73453 No auth

    Arista EOS - Remote Code Execution

    Arista EOS contains a remote code execution caused by crafted malicious packets during P4Runtime session initiation, letting unauthenticated attackers gain complete administrative control, exploit requires P4Runtime enabled and network access.

  • 9.1 /10 Critical
    CVE-2026-73447 Auth required

    Arista EOS - Command Injection & Privilege Escalation

    Arista EOS-based products contain a command injection caused by crafted requests to gRPC Network Security Interface (gNSI) Certz and Bootz services, letting authenticated attackers escalate privileges and execute arbitrary OS commands.

  • 7.4 /10 High
    CVE-2026-73446

    Arista EOS - Denial of Service

    Arista EOS with IS-IS configured on broadcast interfaces contains a denial of service caused by crafted IS-IS Hello PDUs, letting unauthenticated attackers disrupt IS-IS adjacencies and traffic, exploit requires network access to IS-IS adjacency.

  • 7.5 /10 High
    CVE-2026-73439 Auth required

    Arista EOS - Broken Access Control

    Arista EOS contains a broken access control vulnerability caused by improper enforcement of gNSI Pathz policy rules when both group and user rules exist for the same path, letting authenticated users gain unauthorized read/write access to gNMI paths, exploit requires authenticated user access.

  • 8.2 /10 High
    CVE-2026-73435 No auth

    Arista EOS - Denial of Service

    Arista EOS with OSPFv2 configured contains a denial of service caused by specially crafted unauthenticated OSPFv2 packets, letting unauthenticated attackers cause adjacency flapping and packet loss, exploit requires attacker on same broadcast segment.

  • 8.2 /10 High
    CVE-2026-71180 Auth required

    Dell Update Package Framework - Privilege Escalation

    Dell Update Package Framework < 26.07.03 contains an unchecked return value vulnerability, letting low privileged local attackers escalate privileges, exploit requires local access with low privileges.

  • 7.3 /10 High
    CVE-2026-71179 Auth required

    Dell Update Package Framework - Privilege Escalation

    Dell Update Package Framework < 26.07.03 contains an OS command injection caused by improper neutralization of special elements, letting low privileged local attackers escalate privileges, exploit requires local access.