Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 60 of 677
- 10.0 /10 CriticalCVE-2026-89111
SAP Cloud SDK for Python - Server Side Request Forgery
SAP Cloud SDK for Python contains a server side request forgery caused by improper validation of tenant_subdomain parameter in OAuth2 token requests, letting attackers exfiltrate client credentials by redirecting requests to attacker-controlled servers, exploit requires control over tenant_subdomain parameter.
- 9.9 /10 CriticalCVE-2026-89110 Auth required
SAP NetWeaver Visual Composer - Broken Access Control
SAP NetWeaver Visual Composer contains a broken access control vulnerability caused by insufficient authorization checks in portal functionality, letting low-privilege attackers invoke internal operations on remote systems, potentially leading to full system compromise.
- 9.1 /10 CriticalCVE-2026-89108 Auth required
SAP Manufacturing Integration and Intelligence - Broken Access Control
SAP Manufacturing Integration and Intelligence contains a broken access control vulnerability caused by insufficient enforcement of authorization boundaries in administrative functions, letting attackers with MII administrator privileges escalate privileges on the underlying Java application server, exploit requires MII administrator privileges.
- 9.9 /10 CriticalCVE-2026-89107 Auth required
SAP S/4HANA - Insecure Deserialization
SAP S/4HANA contains an insecure deserialization vulnerability caused by insufficient validation of input in rule definition functionality using a domain-specific scripting language, letting authenticated attackers with specific business privileges execute arbitrary ABAP code, exploit requires specific business privileges.
- 7.1 /10 HighCVE-2026-88964 Auth required
OpenVPN - Integer Underflow
OpenVPN 2.7_alpha3 through 2.7.7 on Windows and Android contains an integer underflow caused by crafted domain search options, letting remote authenticated servers cause denial of service or memory disclosure.
- 8.8 /10 HighCVE-2026-88219 No auth
RPC Runtime - Remote Code Execution
RPC Runtime contains an untrusted pointer dereference vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 7.8 /10 HighCVE-2026-88210 No auth
Microsoft Office Word - Authentication Bypass
Microsoft Office Word contains a security feature bypass caused by reliance on untrusted inputs in a security decision, letting unauthorized local attackers bypass security features, exploit requires local access.
- 7.5 /10 HighCVE-2026-88207 No auth
Microsoft Office PowerPoint - Remote Code Execution
Microsoft Office PowerPoint contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 7.5 /10 HighCVE-2026-88206 Auth required
Microsoft Office SharePoint - Privilege Escalation
Microsoft Office SharePoint contains a server side request forgery caused by improper request validation, letting authorized attackers elevate privileges over a network, exploit requires attacker authorization.
- 7.3 /10 HighCVE-2026-88204 Auth required
Microsoft Office SharePoint - Stored XSS
Microsoft Office SharePoint contains a stored XSS caused by improper neutralization of input during web page generation, letting authorized attackers perform spoofing over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-88202 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-88200 Auth required
Microsoft Office SharePoint - Privilege Escalation
Microsoft Office SharePoint contains a privilege escalation caused by privilege context switching error, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-88198 Auth required
Microsoft Office SharePoint - Broken Access Control
Microsoft Office SharePoint contains a broken access control caused by missing authorization checks, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 8.8 /10 HighCVE-2026-88197 No auth
Microsoft Office - Remote Code Execution
Microsoft Office contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-88196 No auth
Microsoft Office - Remote Code Execution
Microsoft Office contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.