Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 58 of 677

  • 7.5 /10 High
    CVE-2026-95114 No auth

    libwebsockets - Denial of Service

    libwebsockets contains an out-of-bounds read vulnerability caused by improper bounds checking in the LEJP incremental parser in lib/misc/lejp.c, letting remote attackers cause denial of service, exploit requires crafted network requests.

  • 10.0 /10 Critical
    CVE-2026-94603 No auth

    Podman - Broken Access Control

    Podman 4.4.0 to 5.8.8 and 6.1.3 contains a broken access control vulnerability caused by treating images with io.podman.annotations.checkpoint.runtime.name annotation as checkpoints, letting attackers bypass container creation restrictions, exploit requires use of affected image annotations.

  • 8.8 /10 High
    CVE-2026-94512 Auth required

    Microsoft SQL Server - Buffer Overflow

    Microsoft SQL Server contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers execute code remotely over a network, exploit requires valid credentials.

  • 7.5 /10 High
    CVE-2026-94453 No auth

    Libreswan - Use After Free

    Libreswan pluto daemon contains a use-after-free vulnerability caused by retaining invalid pointers after IKE over TCP client disconnects, letting remote attackers cause denial of service or possibly remote code execution, exploit requires IKE over TCP enabled with listen-tcp=yes.

  • 9.1 /10 Critical
    CVE-2026-93909 No auth

    IBM WebSphere Application Server Liberty - Authentication Bypass

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 contains an authentication bypass caused by samlWeb-2.0 feature enabled, letting attackers bypass authentication, exploit requires samlWeb-2.0 feature enabled.

  • 8.1 /10 High
    CVE-2026-93907 No auth

    IBM WebSphere Application Server - Authentication Bypass

    IBM WebSphere Application Server 8.5 and 9.0 contain an authentication bypass caused by a flaw in the CSIv2 inbound propagation handler, letting remote attackers bypass authentication, exploit requires network access.

  • 8.2 /10 High
    CVE-2026-93905 No auth

    IBM WebSphere Application Server Liberty - Broken Access Control

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 contains a data tampering vulnerability caused by improper handling of batch job instance status persistence, letting unauthenticated remote attackers corrupt batch job statuses, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-93895 No auth

    IBM WebSphere Application Server Liberty - Access Control Bypass

    IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 contains an access control bypass caused by improper enforcement on gRPC service methods, letting unauthenticated remote attackers bypass access controls.

  • 8.3 /10 High
    CVE-2026-93886 Auth required

    IBM i - Stored XSS

    IBM i 7.3, 7.4, 7.5, and 7.6 contain a stored XSS vulnerability caused by improper validation of user-supplied input, letting remote authenticated attackers execute arbitrary script code.

  • 8.1 /10 High
    CVE-2026-92922 Auth required

    Adobe Commerce - Stored XSS

    Adobe Commerce contains a stored XSS caused by insufficient input sanitization in form fields, letting high-privileged attackers inject malicious scripts executed in victim browsers, exploit requires high privileges.

  • 8.7 /10 High
    CVE-2026-92911 Auth required

    Adobe Commerce - Stored XSS

    Adobe Commerce contains a stored XSS caused by improper sanitization of form fields, letting low-privileged attackers inject malicious scripts executed in victim browsers, exploit requires low-privileged access.

  • 7.2 /10 High
    CVE-2026-92910 No auth

    Adobe Commerce - Broken Access Control

    Adobe Commerce contains an incorrect authorization vulnerability caused by flawed access control, letting attackers bypass security features to gain unauthorized read and limited write access, exploit requires no user interaction.

  • 9.8 /10 Critical
    CVE-2026-92909 No auth

    Adobe Commerce - Broken Access Control

    Adobe Commerce contains an incorrect authorization vulnerability that allows arbitrary code execution in the context of the current user, letting attackers execute arbitrary code without user interaction.

  • 8.3 /10 High
    CVE-2026-92908 Auth required

    Adobe Commerce - Broken Access Control

    Adobe Commerce contains an incorrect authorization vulnerability caused by flawed access control, letting low-privileged attackers bypass security features to gain unauthorized read and write access, exploit requires no user interaction.

  • 9.0 /10 Critical
    CVE-2026-92892

    CVE-2026-92892

    Potential arbitrary code execution, under specific configurations.