Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 573 of 677

  • 7.3 /10 High
    CVE-2024-58383 Auth required

    Froxlor - Broken Access Control

    Froxlor <= 2.2.0-rc3 contains an information disclosure vulnerability caused by insecure file permissions on /etc/pure-ftpd/db/mysql.conf, letting unprivileged local users read database credentials, exploit requires pure-ftpd usage and local code execution.

  • 8.8 /10 High
    CVE-2023-50461 Auth required

    TYPO3 Direct Mail - Configuration Injection & Arbitrary Code Execution

    TYPO3 Direct Mail extension through 9.5.1 contains a configuration injection caused by arbitrary TSConfig page write in the Configuration backend module, letting authenticated backend users inject configuration or execute code, exploit requires valid backend user access.

  • 8.8 /10 High
    CVE-2023-46273 Auth required

    Extreme Networks IQ Engine - Buffer Overflow

    Extreme Networks IQ Engine before 10.6r1a and 10.6r4 before 10.6r5 contains a buffer overflow caused by ah_event_send in ah_bgd, letting attackers cause memory corruption or remote code execution, exploit requires crafted input.

  • 8.6 /10 High
    CVE-2023-45858 No auth

    Paessler PRTG - Path Traversal

    Paessler PRTG < 23.4.88.1429 contains a path traversal caused by improper input validation, letting attackers read local files remotely, exploit requires network access.

  • 7.5 /10 High
    CVE-2023-32803 No auth

    Amazon Linux 2 ca-certificates - Misconfiguration

    Amazon Linux 2 ca-certificates package < 2021.2.50-72 contains a trust store misconfiguration caused by improper removal of certain TrustCor root certificates, letting attackers potentially trust malicious certificates, exploit requires vulnerable root store.

  • 7.2 /10 High
    CVE-2023-28148 No auth

    Paessler PRTG - Stored XSS

    Paessler PRTG < 23.3.86.1520 contains a stored XSS caused by improper sanitization of bodyclass input, letting remote attackers execute scripts in users' browsers, exploit requires user interaction.

  • 7.8 /10 High
    CVE-2026-90783 No auth

    MKVToolNix - Remote Code Execution

    MKVToolNix through 101.0 contains a heap buffer overflow caused by integer wraparound in 32-bit arithmetic in the avilib library's ODML superindex parser, letting attackers execute arbitrary code via crafted AVI files, exploit requires file parsing.

  • 7.5 /10 High
    CVE-2026-90780 No auth

    SIPp - Buffer Overflow

    SIPp <= 3.7.7 contains a buffer overflow caused by processing SIP messages with headers exceeding 20,490 bytes in get_header() function, letting unauthenticated remote attackers crash the process.

  • 7.5 /10 High
    CVE-2026-90779 No auth

    SIPp - Denial of Service

    SIPp <= 3.7.7 contains a buffer overflow caused by processing SIP authentication challenges with oversized algorithm parameters in createAuthHeader(), letting malicious SIP servers crash the client process, exploit requires interaction with crafted SIP challenges.

  • 7.5 /10 High
    CVE-2026-90778 No auth

    SIPp - Buffer Overflow

    SIPp <= 3.7.7 contains a buffer overflow caused by processing SIP To headers with tag parameters of 2049 bytes or more in get_peer_tag() function, letting unauthenticated remote attackers crash the process.

  • 8.8 /10 High
    CVE-2026-90777

    ESPnet - Insecure Deserialization

    ESPnet before 202609 contains an insecure deserialization vulnerability caused by torch.load with weights_only=False in pretrained model checkpoint loading, letting attackers execute arbitrary code via crafted checkpoint files, exploit requires loading malicious files.

  • 7.5 /10 High
    CVE-2026-90776 No auth

    Nodemailer - Denial of Service

    Nodemailer 9.1.0 through 10.0.4 contains a denial of service caused by quadratic time complexity in the addressparser component when parsing email addresses with RFC 5322 comments, letting attackers block the Node.js event loop, exploit requires crafted email headers.

  • 7.5 /10 High
    CVE-2026-90774 No auth

    rustypaste - Path Traversal

    rustypaste before 0.18.1 contains a path traversal caused by improper validation of the custom filename HTTP header, letting attackers write files outside the upload directory, exploit requires crafted HTTP requests.

  • 7.6 /10 High
    CVE-2026-90772

    Amundsen frontend - Stored XSS

    Amundsen frontend through 4.3.0 contains a stored XSS caused by rendering descriptions with dangerouslySetInnerHTML without sanitization in ResourceListItem components, letting attackers inject malicious scripts via metadata or Elasticsearch, exploit requires attacker to inject malicious markup.

  • 8.8 /10 High
    CVE-2026-90770 Auth required

    Spug - Remote Code Execution

    Spug 3.4.0 contains a remote code execution caused by unsanitized user input in the ping_check function, letting authenticated users with monitor permissions execute arbitrary commands via /monitor/run_test/ endpoint.