Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 493 of 681

  • 7.5 /10 High
    CVE-2026-18212 No auth

    Keycloak - Denial of Service

    Keycloak contains a denial of service caused by failure to release native zlib memory in SAML Redirect Binding compression helpers, letting unauthenticated attackers exhaust native memory via repeated malformed SAML requests.

  • 7.2 /10 High
    CVE-2026-17526 Auth required

    Keycloak - Broken Access Control

    Keycloak contains a broken access control vulnerability caused by improper impersonation role checks, letting users with impersonation role gain full administrative control over the realm, exploit requires impersonation role.

  • 9.8 /10 Critical
    CVE-2026-14349 No auth

    TrueBooker – Appointment Booking and Scheduler System - Authorization Bypass

    TrueBooker – Appointment Booking and Scheduler System WordPress plugin <= 1.2.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers modify email addresses and reset passwords.

  • 9.8 /10 Critical
    CVE-2026-12793 PoC publicNo auth

    JetFormBuilder WordPress - Privilege Escalation

    JetFormBuilder WordPress plugin <= 3.6.2 contains a privilege escalation caused by lack of validation of form ID ownership before parsing form schema and executing server-side callbacks, letting unauthenticated attackers create admin accounts.

  • 7.5 /10 High
    CVE-2026-1168 No auth

    GitLab CE/EE - Denial of Service

    GitLab CE/EE 18.4.6 < versions < 19.1.8, 19.2 < versions < 19.2.6, and 19.3 < versions < 19.3.2 contain a denial of service caused by improper resource allocation limits in GraphQL complexity calculation logic, letting unauthenticated users cause service disruption, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2025-59953 No auth

    LMDeploy - Remote Code Execution

    LMDeploy 0.9.1 to < 0.10.2 contains a remote code execution caused by unsanitized use of pickle.loads() in AsyncRPCServer's call_and_response(), letting remote attackers execute arbitrary code via crafted RPC messages, exploit requires network access to RPC server.

  • 7.6 /10 High
    CVE-2025-56565

    DD-WRT TP-Link TL-WR740N - Authentication Bypass

    DD-WRT firmware on TP-Link TL-WR740N v1 through v4 stores sensitive authentication credentials in cleartext within non-volatile memory, letting attackers with physical access extract credentials and compromise the device and network.

  • 9.8 /10 Critical
    CVE-2025-56563 No auth

    Zenith Satellite Tracker - Server Side Request Forgery

    Zenith Satellite Tracker 1.0 contains a server side request forgery caused by lack of host or scheme validation in sat_proxy.php's URL parameter, letting unauthenticated remote attackers make arbitrary HTTP/HTTPS requests.

  • 8.1 /10 High
    CVE-2025-43936 No auth

    Dell ObjectScale - Authentication Bypass

    Dell ObjectScale < 4.4.0.0 contains an improper authentication vulnerability, letting unauthenticated remote attackers gain unauthorized access, exploit requires remote network access.

  • 7.5 /10 High
    CVE-2025-14871 No auth

    GitLab - Denial of Service

    GitLab CE/EE 18.4.6 < versions < 19.1.8, 19.2 < versions < 19.2.6, and 19.3 < versions < 19.3.2 contain a denial of service caused by improper resource allocation limits in GraphQL complexity calculation logic, letting unauthenticated users cause service disruption, exploit requires no authentication.

  • 7.8 /10 High
    CVE-2026-92248 No auth

    GIMP file-psd - Buffer Overflow

    GIMP file-psd plugin contains a heap-based buffer overflow caused by an integer overflow during thumbnail generation from crafted PSD files, letting attackers execute arbitrary code or crash the application, exploit requires crafted PSD file.

  • 9.1 /10 Critical
    CVE-2026-92240 No auth

    Thunderbird - Denial of Service

    Thunderbird contains an out-of-bounds read caused by processing untagged '* ID' responses in the IMAP response parser, letting remote attackers crash the application before authentication.

  • 8.1 /10 High
    CVE-2026-92239 No auth

    Thunderbird - Out of Bounds Read

    Thunderbird contains an out-of-bounds read caused by a maliciously constructed IMAP line, letting attackers potentially read memory out of bounds, exploit requires crafted IMAP input.

  • 9.8 /10 Critical
    CVE-2026-92238 No auth

    Thunderbird - Memory Safety Violation

    Thunderbird contains a mail header parsing vulnerability caused by maliciously constructed headers, letting attackers cause memory safety violations or merge multiple fields, exploit requires crafted mail headers.

  • 7.8 /10 High
    CVE-2026-92180 Auth required

    pdfforge PDF Architect - Uncontrolled Search Path Element Privilege Escalation

    pdfforge PDF Architect contains an uncontrolled search path element vulnerability in the activation-service process, letting local attackers escalate privileges by loading a library from an unsecured location, exploit requires low-privileged code execution.