Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 590 of 677
- 9.1 /10 CriticalCVE-2026-89537
Linux Kernel - Buffer Over-read
Linux kernel contains a buffer over-read vulnerability in SUNRPC gss_krb5_verify_mic_v2 caused by missing length checks on short RFC 4121 MIC tokens, letting malicious NFS servers cause out-of-bounds reads, exploit requires malicious NFS server.
- 9.8 /10 CriticalCVE-2026-89536
CVE-2026-89536
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops that reference after calling tls_handshake_cancel(). handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. In that case the completion callback can still be running, so dropping the callback-owned reference in the waiter can free the lower transport before xs_tls_handshake_done() stores xprt_err or drops its own reference. If cancellation loses to completion, wait until xs_tls_handshake_done() signals handshake_done and let the callback release its reference. This mirrors the server-side handshake lifetime handling and keeps the timeout or signal return value unchanged.
- 8.1 /10 HighCVE-2026-89535
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by improper ordering of rpcrdma_rn_unregister and rdma_destroy_id calls in svcrdma, letting concurrent ib_unregister_device access freed memory, exploit requires concurrent device unregistration.
- 8.8 /10 HighCVE-2026-89534 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in svcrdma caused by failure to clear sc_cm_id when ADDR_CHANGE replacement fails, letting attackers cause memory corruption, exploit requires triggering RDMA address change event.
- 9.8 /10 CriticalCVE-2026-89533
Linux Kernel - Integer Overflow
Linux kernel contains an integer underflow and arithmetic defect in svcrdma's svc_rdma_read_chunk_range function, caused by incorrect offset handling in segment length calculation, letting attackers trigger excessive memory allocation, exploit requires crafted RDMA read chunks.
- 9.1 /10 CriticalCVE-2026-89532 No auth
Linux Kernel - Out of Bounds Read
Linux kernel contains an out-of-bounds read caused by incorrect upper bound calculation in svcrdma pcl_for_each_segment macro when processing chunks with zero segments, letting remote attackers cause a general protection fault, exploit requires crafted network packets.
- 9.8 /10 CriticalCVE-2026-89530 No auth
Linux Kernel svcrdma - Buffer Overflow
Linux kernel svcrdma contains a buffer overflow caused by improper handling of inline replies that exceed the pull-up buffer size, letting remote RPC-over-RDMA clients cause memory corruption, exploit requires crafted RPC requests without Write list or Reply chunk.
- 7.5 /10 HighCVE-2026-89528 No auth
Linux Kernel svcrdma - Denial of Service
Linux kernel svcrdma contains a null pointer dereference caused by improper validation of cumulative Read segment lengths exceeding the page budget in svc_rdma_build_read_segment, letting remote attackers cause denial of service, exploit requires crafted request.
- 9.8 /10 CriticalCVE-2026-89526 No auth
Linux kernel svcrdma - Buffer Over-read
Linux kernel svcrdma contains a buffer over-read caused by improper validation of RPC/RDMA Read chunk positions, letting remote clients cause memory corruption or information disclosure, exploit requires crafted RPC/RDMA requests.
- 8.1 /10 HighCVE-2026-89524 No auth
Linux Kernel - Information Disclosure
Linux kernel contains an information disclosure vulnerability in ath6kl_cfg80211_connect_event() caused by underflow of assoc request/response lengths due to missing lower bound checks, letting attackers disclose adjacent slab memory, exploit requires crafted assoc request/response.
- 7.8 /10 HighCVE-2026-89523
Linux Kernel mt76 mt7925 - Use After Free
Linux kernel mt76 mt7925 contains a use-after-free vulnerability caused by pending mlo_pm_work running after device reset, suspend, or unregister, letting attackers cause memory corruption or instability, exploit requires device state changes.
- 7.8 /10 HighCVE-2026-89522 Auth required
Linux Kernel media staging/ipu7 - Use After Free
Linux kernel media staging/ipu7 contains a use-after-free caused by improper cleanup of async notifier on probe error path in isys_register_devices, letting attackers cause list corruption and potential memory corruption, exploit requires device probe failure.
- 7.3 /10 HighCVE-2026-89521
CVE-2026-89521
In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick_task() releasing the rq lock Core scheduling's pick_next_task() breaks when a ->pick_task() implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held continuously. Once a pick can drop the lock, an interleaving selection can invalidate all of it: the single-CPU fast path can commit an uncookied pick although the core went cookied during the release, and forceidle committed by the interleaving selection skews the restarted pass's accounting. Fix it by restarting the whole selection when a pick returns RETRY_TASK after releasing the lock: a single restart point above the state derivation replaces the per-loop restart labels, so a retry picks up state committed by interleaving selections and accounts and resets forceidle like a fresh selection would. need_sync and fi_before latch across retries. Clock validity can't be re-derived - there is no program-ordered way to tell whether the own and core rq clocks are still updated after the lock was released, as other lockers' pin cycles may or may not have invalidated them. When restarting, clear core_clock_updated so that the sibling loop re-updates the core rq, and update the own rq clock if invalidated.
- 7.8 /10 HighCVE-2026-89520
CVE-2026-89520
In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's pick_next_task() operates on all sibling rqs under one acquisition of the shared core-wide lock. A ->pick_task() that releases the rq lock leaves every sibling __lock momentarily free, letting __sched_core_flip(false) complete mid-selection and rebind rq_lockp() under it. The selection resumes on the split locks, touching sibling state it no longer protects, and __schedule() finally releases a lock that was never taken while leaking the one that was. Count in-flight core-wide selections in the leader's rq->core_pick_in_flight and make __sched_core_flip() wait for the count to drain. The count only changes under the shared lock, which the flip holds while sampling, so no other ordering is needed. The wait can repeat while selections overlap, but the flip backs off between samples and flips are rare cookie-lifetime events. sched_core_cpu_deactivate() moves the count to the new leader - a stale copy left behind would bias it forever if that CPU later returns as its own leader.
- 8.8 /10 HighCVE-2026-89513 Auth required
Linux Kernel KVM - Out-of-Bounds Read/Write
Linux kernel KVM on RISC-V contains an out-of-bounds read/write caused by incorrect PMU event info array size calculation in kvm_riscv_vcpu_pmu_event_info, letting nested guest attackers cause memory corruption, exploit requires nested guest access.