Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 544 of 677

  • 7.5 /10 High
    CVE-2026-69213 No auth

    Http4s - Denial of Service

    Http4s prior to 0.23.35 and 1.0.0-M47 contains a denial of service caused by unbounded queue exhaustion in Ember HTTP/2 frame serialization, letting unauthenticated HTTP/2 clients exhaust server heap memory, exploit requires network access to send frames.

  • 7.5 /10 High
    CVE-2026-69210 No auth

    Http4s - Denial of Service

    Http4s < 0.23.35 and < 1.0.0-M47 contain a denial of service caused by improper handling of negative 64-bit WebSocket frame lengths in FrameTranscoder.bodyLength, letting remote clients cause infinite decode loops and resource exhaustion, exploit requires completing a WebSocket handshake through Ember server.

  • 7.5 /10 High
    CVE-2026-69209 No auth

    Http4s - Denial of Service

    Http4s < 0.23.35 and < 1.0.0-M47 contain a denial of service caused by unbounded WebSocket message buffering in the shared decoder, letting remote clients exhaust server memory with oversized frames, exploit requires completing WebSocket handshake.

  • 7.5 /10 High
    CVE-2026-69208 No auth

    Http4s - Denial of Service

    Http4s < 0.23.35 and < 1.0.0-M47 contain a denial of service caused by inverted stale-nonce comparison in DigestAuth middleware, letting unauthenticated attackers exhaust JVM heap memory by triggering repeated authentication challenges.

  • 8.7 /10 High
    CVE-2026-69205 No auth

    Http4s - Server Side Request Forgery

    Http4s prior to 0.23.35 and 1.0.0-M47 contains a server-side request forgery caused by case-sensitive substring test and improper charset decoding in Ember's HeaderP.parse, letting attackers perform request smuggling and cache poisoning, exploit requires crafted HTTP requests.

  • 7.5 /10 High
    CVE-2026-69203 No auth

    Http4s - Denial of Service

    Http4s < 0.23.35 and < 1.0.0-M47 contain a denial of service caused by lack of enforcement of SETTINGS_MAX_CONCURRENT_STREAMS in HTTP/2, letting unauthenticated attackers exhaust heap memory by opening unlimited streams, exploit requires HTTP/2 enabled.

  • 7.5 /10 High
    CVE-2026-69202 No auth

    Http4s - Denial of Service

    Http4s prior to 0.23.35 and 1.0.0-M47 contains a denial of service caused by unbounded HTTP/2 flow-control window replenishment and unbounded per-stream data buffering, letting hostile peers exhaust heap memory, exploit requires HTTP/2 usage with ember-server or ember-client.

  • 8.8 /10 High
    CVE-2026-68950 No auth

    Affected Products - Authentication Bypass

    Affected products contain hardcoded credentials in the ftpd service, letting remote attackers run the service as root and gain root file access, exploit requires FTP service to be reachable.

  • 8.8 /10 High
    CVE-2026-68070 No auth

    Affected products - Command Injection

    Affected products contain a command injection caused by missing authentication for a critical function, letting attackers execute system commands as root, exploit requires missing authentication.

  • 9.6 /10 Critical
    CVE-2026-66890 No auth

    Affected Products - Hardcoded Credentials

    Affected products contain hardcoded credentials allowing remote attackers to access files with root privileges via FTP, exploit requires FTP service to be reachable.

  • 9.6 /10 Critical
    CVE-2026-66887

    CVE-2026-66887

    The affected products are missing authorization on state-changing CGIs and session checks are not performed.

  • 7.7 /10 High
    CVE-2026-65831 Auth required

    ArcadeDB - File Inclusion

    ArcadeDB prior to 26.7.1 contains a file system read vulnerability caused by insufficient authorization enforcement in PolyglotQueryEngine and GraalPolyglotEngine allowing read-only users to read arbitrary host files, exploit requires reader-role user privileges.

  • 9.1 /10 Critical
    CVE-2026-63696 Auth required

    Dell SmartFabric OS10 Software - Remote Code Execution

    Dell SmartFabric OS10 Software < 10.6.1.3 contains a download of code without integrity check vulnerability, letting high privileged remote attackers execute arbitrary code, exploit requires high privileges.

  • 9.8 /10 Critical
    CVE-2026-63695

    Dell SmartFabric OS10 Software - Authentication Bypass

    Dell SmartFabric OS10 Software < 10.6.1.3 contains a session fixation vulnerability caused by improper session management, letting unauthenticated remote attackers steal sessions, exploit requires remote access.

  • 8.3 /10 High
    CVE-2026-63443 Auth required

    Coder - Broken Access Control

    Coder < 2.29.19, 2.32.9, 2.33.10, and 2.34.4 contains a broken access control caused by improper handling of HTTP redirects in agentConn.apiClient(), letting authenticated users redirect requests to other agents to read/write files and execute commands across workspace boundaries, exploit requires authenticated user controlling a modified workspace agent and knowledge of victim agent UUID.