Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 566 of 677

  • 7.8 /10 High
    CVE-2026-65357 Auth required

    Apple - Buffer Overflow

    Apple iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 contain a memory corruption vulnerability caused by improper memory handling, letting apps cause system termination or write kernel memory, exploit requires malicious app execution.

  • 8.2 /10 High
    CVE-2026-65354 Auth required

    Apple iOS & iPadOS & macOS - Privilege Escalation

    Apple iOS 27, iPadOS 27, and macOS Golden Gate 27 contain a sandbox escape vulnerability caused by insufficient permissions restrictions, letting malicious apps break out of their sandbox, exploit requires malicious app installation.

  • 7.8 /10 High
    CVE-2026-65344 No auth

    Apple - Denial of Service

    Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, and visionOS 27 contain an out-of-bounds write caused by improper bounds checking in video file processing, letting attackers cause denial of service by crashing the app, exploit requires processing a maliciously crafted video file.

  • 7.5 /10 High
    CVE-2026-65342 No auth

    Apple macOS - Broken Access Control

    Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a broken access control caused by insufficient validation, letting applications access sensitive user data, exploit requires app execution.

  • 7.8 /10 High
    CVE-2026-64790 No auth

    Apple macOS - Broken Access Control

    Apple macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 contain a broken access control caused by a path handling issue due to insufficient validation, letting apps gain elevated privileges, exploit requires app execution.

  • 7.5 /10 High
    CVE-2026-64761 No auth

    Apple iOS & iPadOS - Information Disclosure

    Apple iOS 27 and iPadOS 27 contain an information disclosure vulnerability caused by improper handling of user preferences, letting apps identify other installed apps, exploit requires app installation.

  • 7.3 /10 High
    CVE-2026-64752 Auth required

    Apple - Buffer Overflow

    Apple iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 contain a buffer overflow caused by processing a maliciously crafted image, letting attackers execute arbitrary code, exploit requires crafted image input.

  • 7.1 /10 High
    CVE-2026-64736 Auth required

    Apple iOS & macOS - Out of Bounds Read/Write

    Apple iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27 contain an out-of-bounds read/write caused by insufficient bounds checking, letting apps cause system termination or kernel memory corruption, exploit requires malicious app.

  • 7.8 /10 High
    CVE-2026-64712 Auth required

    Apple macOS - Privilege Escalation

    Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a privilege escalation caused by insufficient privilege checks, letting local apps gain root privileges, exploit requires local app execution.

  • 7.8 /10 High
    CVE-2026-64701 Auth required

    Apple macOS - Privilege Escalation

    Apple macOS Sequoia 15.7.8 and macOS Tahoe 26.6 contain a privilege escalation caused by insufficient permission restrictions, letting malicious apps gain root privileges, exploit requires malicious app execution.

  • 8.8 /10 High
    CVE-2026-61701 Auth required

    Laravel MagicLink - Remote Code Execution

    Laravel MagicLink 2.0.0 to 2.25.1 contains an insecure deserialization vulnerability caused by unsafe unserialize() fallback in magic_links.action column, letting attackers with database write access execute arbitrary code, exploit requires database record manipulation.

  • 9.1 /10 Critical
    CVE-2026-61534 No auth

    Yayson - Prototype Pollution

    Yayson < 4.3.0 contains a prototype pollution vulnerability caused by attacker-controlled JSON:API type, id, and relationship names used as keys in object lookup tables, letting attackers cause process-wide prototype pollution, exploit requires crafted JSON:API documents.

  • 7.5 /10 High
    CVE-2026-59960

    Argos JavaScript - Command Injection

    Argos JavaScript core package < 6.2.1 contains a command injection caused by untrusted CI branch or ref values interpolated into execSync() shell commands, letting attackers execute arbitrary commands with CI runner privileges, exploit requires attacker-controlled CI branch or ref.

  • 7.5 /10 High
    CVE-2026-59570

    Zscaler Client Connector - Denial of Service

    Zscaler Client Connector contains a denial of service caused by a pre-installed peer app tearing down the Zscaler tunnel, letting attackers force user logout and toggle packet capture, exploit requires pre-installed peer app.

  • 8.1 /10 High
    CVE-2026-59569 Auth required

    Zscaler Client Connector - Authentication Bypass

    Zscaler Client Connector on Android and ChromeOS contains an improper input validation vulnerability, letting attackers potentially bypass Zscaler controls, exploit requires crafted input.