Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 551 of 677

  • 8.8 /10 High
    CVE-2026-52484 Auth required

    MitraStar GPT-2742GX4X5v6-SV - Command Injection

    MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 contains a command injection caused by improper input handling in /cgi-bin/device-management-utilities-internet.cgi, letting authenticated attackers execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-51134 No auth

    C-MOR Video Surveillance - Path Traversal

    C-MOR Video Surveillance up to 6.0104 contains a path traversal caused by improper validation of the 'cam' parameter in show-movies.pml, letting remote attackers access arbitrary files, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-45579 Auth required

    DIRAC - Command Injection

    DIRAC < 8.0.79, 9.0.22, 9.1.10 contains a command injection caused by unsafe evaluation of caller-controlled groupingAttribute in ReqManagerHandler.py, letting authenticated attackers execute OS commands, exploit requires authentication.

  • 8.5 /10 High
    CVE-2026-45048 Auth required

    Open Access Management (OpenAM) - Broken Access Control

    Open Access Management (OpenAM) < 16.1.1 contains a broken access control vulnerability caused by lack of ownership and privilege checks in SessionRequestHandler, letting low-privileged authenticated users hijack other users' sessions, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-40058 Auth required

    CrowdStrike Falcon - Local Privilege Escalation

    CrowdStrike Falcon sensor for Windows (versions 7.34+, 7.32 LTS, 7.16 on Windows 7/2008 R2) contains an arbitrary file write vulnerability caused by Microsoft Office File Malicious Macro Removal policy enabled, letting unprivileged attackers escalate privileges locally, exploit requires the specific Windows policy enabled.

  • 9.8 /10 Critical
    CVE-2026-39919 No auth

    Ghostscript - Remote Code Execution

    Ghostscript < 10.08.0 contains a heap-based buffer overflow caused by mismatched component subsampling factors in JPEG 2000 output adapter, letting attackers cause memory corruption and execute code via crafted PDF, exploit requires crafted PDF input.

  • 9.8 /10 Critical
    CVE-2026-37152 No auth

    TOTOLINK X5000R - Hardcoded Credentials

    TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a hardcoded password vulnerability caused by embedded root credentials, letting attackers gain unauthorized root access, exploit requires no special conditions.

  • 7.8 /10 High
    CVE-2026-19886 No auth

    OriginLab Origin Viewer - Remote Code Execution

    OriginLab Origin Viewer contains a remote code execution vulnerability caused by improper validation in OGM file parsing, letting remote attackers execute arbitrary code, exploit requires user to open a malicious file or visit a malicious page.

  • 7.8 /10 High
    CVE-2026-19885 No auth

    OriginLab Origin Viewer - Remote Code Execution

    OriginLab Origin Viewer contains an out-of-bounds write caused by improper validation in OGWU file parsing, letting remote attackers execute arbitrary code, exploit requires user to open a malicious file or visit a malicious page.

  • 7.8 /10 High
    CVE-2026-19781 No auth

    Ashlar-Vellum Cobalt - Remote Code Execution

    Ashlar-Vellum Cobalt contains a heap-based buffer overflow caused by improper validation of user-supplied data length in VS file parsing, letting remote attackers execute arbitrary code, exploit requires user interaction.

  • 8.8 /10 High
    CVE-2026-19780 Auth required

    Koha - Code Injection & Remote Code Execution

    Koha contains a code injection vulnerability caused by improper validation of user-supplied strings passed to the eval function in the web service on TCP port 8081, letting authenticated attackers execute arbitrary code remotely.

  • 7.1 /10 High
    CVE-2026-19774 No auth

    BlueZ - Remote Code Execution

    BlueZ contains a stack-based buffer overflow caused by improper validation of user-supplied data length in the A2DP stream endpoints, letting network-adjacent attackers execute arbitrary code as root, exploit requires pairing a malicious Bluetooth device.

  • 9.8 /10 Critical
    CVE-2026-19773 No auth

    libwebsockets - Remote Code Execution

    libwebsockets contains a remote code execution caused by improper validation in HTTP/2 HPACK path header parsing, letting remote attackers execute arbitrary code without authentication.

  • 7.0 /10 High
    CVE-2026-19515 No auth

    WSO2 Integrator MI VS Code extension - Command Injection

    WSO2 Integrator MI VS Code extension contains a command injection caused by improper sanitization of user input in Micro Integrator projects, letting attackers execute arbitrary OS commands via unit test execution, exploit requires workspace trust and test execution.

  • 7.1 /10 High
    CVE-2026-18424 Auth required

    Concrete CMS - Server-Side Request Forgery

    Concrete CMS 9.0.0 to 9.5.2 contains a server-side request forgery caused by cross-port reuse of a host's validated DNS pin in remote file import, letting low-privileged authenticated users access internal resources, exploit requires authenticated file import permission.