Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 602 of 677

  • 8.8 /10 High
    CVE-2026-71416

    Headroom - Authentication Bypass

    Headroom < 0.35.0 contains an authentication bypass caused by lack of Origin header validation in WebSocket requests, letting malicious WebSocket clients perform arbitrary LLM requests without authentication, exploit requires attacker to have access to Headroom proxy and OpenAI API key.

  • 8.5 /10 High
    CVE-2026-70341 Auth required

    Microsoft Edge - Remote Code Execution

    Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows authorized attackers to execute code remotely over a network, exploit requires attacker authorization.

  • 7.5 /10 High
    CVE-2026-68497 No auth

    Jackson-databind - Denial of Service

    Jackson-databind 2.0.0 < 2.18.10, 2.19.0 < 2.21.6, 2.22.0 < 2.22.2, 3.0.0 < 3.1.6, and 3.2.0 < 3.2.2 contains a denial of service caused by unbounded numeric string parsing in XML datatype deserializers, letting unauthenticated attackers exhaust CPU resources via crafted JSON input, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-67211 No auth

    Apache OpenNLP - Denial of Service

    Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 contain a denial of service caused by unbounded map pre-sizing in SymSpellModelSerializer.create() when reading attacker-controlled count fields from a binary model, letting attackers exhaust heap memory, exploit requires loading untrusted SymSpell model files.

  • 7.6 /10 High
    CVE-2026-62112 Auth required

    Amelia - SQL Injection

    Amelia <= 2.4.9 contains a SQL injection caused by improper input sanitization in the editor component, letting attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.6 /10 High
    CVE-2026-62109 Auth required

    Sky Addons for Elementor - SQL Injection

    Sky Addons for Elementor <= 3.8.4 contains a SQL injection caused by improper input sanitization in the editor component, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-62107 Auth required

    Masteriyo - LMS - Remote Code Execution

    Masteriyo - LMS <= 3.4.0 contains an unauthenticated PHP object injection caused by improper handling of user input, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-62106 Auth required

    SMS Alert Order Notifications - Privilege Escalation

    SMS Alert Order Notifications <= 3.9.9 contains a privilege escalation caused by improper access control, letting subscribers escalate their privileges, exploit requires subscriber access.

  • 9.8 /10 Critical
    CVE-2026-62105 No auth

    ThemeREX Addons - Remote Code Execution

    ThemeREX Addons < 2.45.0 contains an unauthenticated PHP Object Injection caused by improper handling of serialized data, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62103 No auth

    Everest Forms - Insecure Deserialization

    Everest Forms <= 3.6.0 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-62102 Auth required

    Gato GraphQL - Privilege Escalation

    Gato GraphQL <= 19.2.3 contains a privilege escalation caused by improper subscriber privilege management, letting attackers escalate their privileges, exploit requires subscriber access.

  • 7.1 /10 High
    CVE-2026-62089 Auth required

    Pixar Labs Master Addons for Elementor - Broken Access Control

    Pixar Labs Master Addons for Elementor <= 3.2.2 contains a broken access control vulnerability caused by missing authorization checks, letting attackers abuse privileges, exploit requires no special conditions.

  • 7.0 /10 High
    CVE-2026-57842 Auth required

    NetBSD - Use After Free

    NetBSD contains a use-after-free and double-free vulnerability caused by a missing return statement in msg_recv_copyin() within the COMPAT_NETBSD32 layer, letting local users trigger kernel panic or memory corruption by calling recvmsg() with specific msg_iovlen values.

  • 7.4 /10 High
    CVE-2026-54241 No auth

    libde265 - Integer Overflow

    libde265 < 1.1.1 contains an integer overflow caused by signed 32-bit arithmetic in sample adaptive offset input-buffer size calculation, letting attackers cause out-of-bounds heap read or crash the decoder, exploit requires crafted HEVC stream.

  • 7.4 /10 High
    CVE-2026-54240 No auth

    libde265 - Integer Overflow

    libde265 < 1.1.1 contains an integer overflow caused by signed 32-bit arithmetic in pixel offset calculations, letting attackers trigger out-of-bounds heap reads or writes, exploit requires crafted HEVC stream with large image dimensions.