Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 600 of 677

  • 7.8 /10 High
    CVE-2026-80933

    Linux kernel mt76 - Out of Bounds Read

    Linux kernel mt76 mt7996 driver contains a buffer overflow caused by lack of length validation of default EEPROM firmware, letting attackers cause out-of-bounds read, exploit requires supplying truncated firmware file.

  • 8.4 /10 High
    CVE-2026-80932 No auth

    Linux Kernel virtio_vsock - Use After Free

    Linux kernel virtio_vsock contains a use-after-free vulnerability caused by improper flushing order of dependent work items in virtio_vsock_remove(), letting attackers cause memory corruption or system instability, exploit requires kernel-level access.

  • 7.8 /10 High
    CVE-2026-80931

    Linux Kernel w1: ds28e17 - Out of Bounds Read

    Linux kernel w1: ds28e17 contains a buffer overflow caused by improper length validation in I2C block read, letting a malicious device cause out-of-bounds read, exploit requires a malicious I2C slave device.

  • 7.8 /10 High
    CVE-2026-80929 Auth required

    Linux Kernel - Broken Access Control

    Linux kernel contains a broken access control vulnerability caused by improper placement of the "cad_pid" sysctl entry in pid_table[], allowing non-root users to modify it via unshared pid/user namespaces, exploit requires namespace unsharing.

  • 7.8 /10 High
    CVE-2026-80928 Auth required

    Linux Kernel - Use After Free

    Linux kernel contains a use-after-free vulnerability in smack_file_send_sigiotask() caused by improper access to task credentials, letting attackers cause memory corruption, exploit requires triggering specific task credential inspection.

  • 9.8 /10 Critical
    CVE-2026-80926 No auth

    Linux Kernel ksmbd - Use After Free

    Linux kernel ksmbd contains a use-after-free vulnerability caused by unsynchronized access to opinfo->conn in oplock break notification, letting authenticated clients with durable batch oplocks cause memory corruption, exploit requires authenticated client with durable batch oplock.

  • 8.3 /10 High
    CVE-2026-80469 No auth

    Device Driver Package - Remote Code Execution

    A device driver package upload mechanism contains a code execution vulnerability caused by bypassing driver verification, letting attackers execute arbitrary code, exploit requires user interaction.

  • 10.0 /10 Critical
    CVE-2026-80462 No auth

    Chef Automate - Broken Access Control

    Chef Automate contains a broken access control vulnerability in the API gateway and identity validation path, letting unauthenticated actors gain elevated access to protected functionality under specific conditions.

  • 9.8 /10 Critical
    CVE-2026-79396 No auth

    Xiongmai IP Camera XM530 - Authentication Bypass

    Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier contains hardcoded default credentials caused by storing static account credentials in unencrypted plaintext within bin/config.xml and Sofia executable, letting remote attackers gain full administrative control, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-79395 No auth

    Xiongmai IP Camera XM530 - Authentication Bypass

    Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier contains an authentication bypass caused by improper WS-Security UsernameToken verification in Sofia IPC daemon, letting remote attackers execute privileged ONVIF actions via crafted SOAP requests when the admin password is empty.

  • 7.5 /10 High
    CVE-2026-79394 No auth

    Xiongmai IP Camera XM530 - Authentication Bypass

    Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier contains an authentication bypass caused by insecure default configuration in the embedded Happytime RTSP server within Sofia IPC daemon, letting remote unauthenticated attackers access live video and audio feeds in cleartext over unencrypted RTP/UDP, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-79393 No auth

    Xiongmai IP Camera XM530 - Buffer Overflow

    Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier contains a heap-based buffer overflow caused by improper handling of wsa5:Action string in WS-Addressing Action transformation function in Sofia IPC daemon, letting remote unauthenticated attackers cause denial of service or execute arbitrary code via crafted SOAP request.

  • 8.8 /10 High
    CVE-2026-79362 Auth required

    Woltlab WCF - Remote Code Execution

    Woltlab WCF >= 6.1.0 < 6.1.23 and >= 6.2.0 < 6.2.6 contain a remote code execution caused by cache poisoning via premature nowdoc termination in executable cache files, letting authenticated low-privileged users execute arbitrary PHP code.

  • 7.1 /10 High
    CVE-2026-78807 Auth required

    wpa_supplicant - Broken Access Control

    wpa_supplicant < 2.12 contains a broken access control vulnerability caused by missing validation in the driver-based PMKSA selection path in wpa.c, letting local attackers bypass proper network context and AKMP matching for PMKSA caching, exploit requires local access.

  • 8.4 /10 High
    CVE-2026-7863 No auth

    TUBITAK BILGEM Pardus Software - OS Command Injection

    TUBITAK BILGEM Pardus Software < 1.0.5 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.