Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 607 of 677

  • 8.1 /10 High
    CVE-2026-88865 Auth required

    AVideo - Broken Access Control

    AVideo contains a broken access control caused by failure to validate restream ownership in getRestream.json.php, letting authenticated users with canStream permission mint tokens for arbitrary restreams and retrieve other users' stream keys.

  • 9.1 /10 Critical
    CVE-2026-88864 Auth required

    Capgo - Broken Access Control

    Capgo contains a broken access control vulnerability caused by unrestricted write access to the public.sso_providers table via Supabase PostgREST, letting attackers with a full API key bypass SSO provisioning controls and enforce arbitrary SSO, exploit requires possession of a full API key.

  • 8.1 /10 High
    CVE-2026-88863 Auth required

    capgo.app capgo - Broken Access Control

    capgo.app npm package capgo through 12.207.1 contains a broken access control vulnerability caused by missing role rank comparison in validateInvite() function, letting authenticated users with org.invite_user permission escalate privileges to org_admin or org_billing_admin, exploit requires authenticated user with org.invite_user permission.

  • 8.8 /10 High
    CVE-2026-88862 Auth required

    Capgo - Broken Access Control

    Capgo backend through 12.242.4 contains a broken access control vulnerability caused by improper validation of parent-child delegation in API key processing, letting authenticated apikey_manager keys escalate privileges by impersonating more privileged sibling keys, exploit requires authenticated apikey_manager API key.

  • 8.3 /10 High
    CVE-2026-88861 PoC publicAuth required

    Capgo - Authentication Bypass

    Capgo contains an authentication bypass caused by improper assurance level validation in Edge JWT middleware and RBAC authorization, letting attackers with only a victim's password perform privileged operations, exploit requires victim's password.

  • 7.5 /10 High
    CVE-2026-88290 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.14 (260903) contains a denial of service caused by unauthenticated clients declaring unbounded VLSVR frame lengths, letting remote attackers exhaust memory and resources, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-88289 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.14 (260903) contains a stack buffer overflow caused by improper validation of variable-length fields in VLSVR request handlers, letting unauthenticated remote attackers cause a denial of service by crashing the service.

  • 7.5 /10 High
    CVE-2026-88287 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.13 contains a buffer overflow caused by unbounded Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, letting remote attackers crash the discovery process.

  • 7.5 /10 High
    CVE-2026-88286 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.13 contains a denial of service vulnerability caused by improper management of PTZ connection state, letting unauthenticated remote clients block new PTZ connections, exploit requires network access.

  • 9.4 /10 Critical
    CVE-2026-88285 No auth

    GeoVision GV-LPC2211 - Broken Access Control

    GeoVision GV-LPC2211 V1.13 contains a broken access control vulnerability caused by an unauthenticated network-accessible PTZ control service, letting remote attackers retrieve PTZ information and issue PTZ or raw serial commands, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-88282 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by administrator-controlled FTP username with shell metacharacters executed during FTP-account update, letting attackers execute arbitrary root commands, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-88278

    GeoVision GV-LPC2211 - Authentication Bypass

    GeoVision GV-LPC2211 V1.13 contains a replay attack vulnerability caused by failure to enforce WS-Security UsernameToken freshness or nonce reuse protection, letting attackers replay captured PasswordDigest tokens for ONVIF operations, exploit requires captured token.

  • 8.8 /10 High
    CVE-2026-88277 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by improper sanitization of ConsumerReference.Address in ONVIF interface, letting authenticated users execute arbitrary commands as root.

  • 7.2 /10 High
    CVE-2026-88276 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by administrator-controlled WEP key values containing shell syntax, letting attackers execute arbitrary commands as root, exploit requires administrator privileges.

  • 7.2 /10 High
    CVE-2026-88275 Auth required

    GeoVision GV-LPC2211 - Command Injection

    GeoVision GV-LPC2211 V1.13 contains a command injection caused by administrator-controlled WPA-PSK with shell syntax in wireless configuration, letting attackers execute arbitrary commands as root, exploit requires administrator privileges.