Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 498 of 681

  • 8.8 /10 High
    CVE-2026-92014 No auth

    Firefox ESR - Privilege Escalation

    Firefox ESR < 115.41 and < 140.16 contain a privilege escalation caused by incorrect boundary conditions in the Graphics component, letting attackers escalate privileges, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-92013

    Firefox - Privilege Escalation

    Firefox contains a privilege escalation caused by incorrect boundary conditions in the Graphics: CanvasWebGL component, letting attackers escalate privileges, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-92012

    Firefox - Privilege Escalation

    Firefox contains a privilege escalation caused by incorrect boundary conditions in the Graphics: CanvasWebGL component, letting attackers escalate privileges, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-92011

    Firefox - Privilege Escalation

    Firefox contains a privilege escalation caused by incorrect boundary conditions in the Graphics: CanvasWebGL component, letting attackers escalate privileges, exploit requires undefined conditions.

  • 8.8 /10 High
    CVE-2026-92010

    Firefox - Privilege Escalation

    Firefox contains a privilege escalation caused by incorrect boundary conditions in the Graphics: CanvasWebGL component, letting attackers escalate privileges, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-92009 No auth

    Firefox - Privilege Escalation

    Firefox contains a privilege escalation caused by incorrect boundary conditions in the Graphics: CanvasWebGL component, letting attackers escalate privileges, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-92008 No auth

    Firefox - Privilege Escalation

    Firefox contains a privilege escalation caused by incorrect boundary conditions in the Graphics: CanvasWebGL component, letting attackers escalate privileges, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-92007

    Firefox - Privilege Escalation

    Firefox contains a privilege escalation caused by incorrect boundary conditions in the Graphics: CanvasWebGL component, letting attackers escalate privileges, exploit requires unspecified conditions.

  • 8.8 /10 High
    CVE-2026-92006 No auth

    Firefox - Privilege Escalation

    Firefox contains a privilege escalation caused by incorrect boundary conditions in the Graphics: CanvasWebGL component, letting attackers escalate privileges, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-92000 No auth

    adm-zip - Denial of Service

    adm-zip 0.5.14 through 0.6.0 contains a denial of service caused by failure to apply zlib decompression output limits when ZIP entries declare zero uncompressed size, letting attackers exhaust memory by crafting malicious ZIP archives, exploit requires crafted ZIP files.

  • 9.9 /10 Critical
    CVE-2026-91998 Auth required

    Casdoor - Authorization Bypass

    Casdoor through 4.4.0 contains an authorization bypass caused by improper access control in the /api/mcp endpoint, letting attackers with any application's clientId and clientSecret gain unrestricted user administration access across all organizations, exploit requires valid clientId and clientSecret from any application.

  • 7.5 /10 High
    CVE-2026-91996 No auth

    lamp-cloud - Information Disclosure

    lamp-cloud <= 5.10.0 contains an information disclosure vulnerability caused by whitelisted path pattern /*/anno/** allowing unauthenticated access to JVM system properties, letting unauthenticated attackers retrieve sensitive system information.

  • 9.1 /10 Critical
    CVE-2026-91995 No auth

    Pig - Authentication Bypass

    Pig < 4.1.0 contains an authentication bypass caused by discarded password verification results in /register/password endpoint, letting remote attackers overwrite any account credentials including admin, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-91990 No auth

    Tornado - Denial of Service

    Tornado < 6.5.8 contains a denial of service vulnerability caused by improper validation of max_parts in parse_multipart_form_data, letting attackers exhaust server memory via crafted multipart requests, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-91989 No auth

    atomic-agents-stack - Path Traversal

    atomic-agents-stack < 1.1.0 contains a path traversal caused by improper path containment checks in DashboardHandler.do_GET, letting remote attackers read arbitrary files by supplying '../' sequences in request paths.