Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 633 of 677

  • 9.1 /10 Critical
    CVE-2026-53939 No auth

    OpenIDC cjose - Cryptographic Key Generation Flaw

    OpenIDC cjose 0.6.1 through 0.6.2.5 contains a cryptographic key generation flaw caused by zeroed content-encryption key in AES-CBC-HMAC JWE encryption, letting attackers decrypt and forge JWE content, exploit requires use of affected algorithms.

  • 8.2 /10 High
    CVE-2026-53938 No auth

    OpenIDC cjose - Out of Bounds Read/Write

    OpenIDC cjose < 0.6.2.5 contains a buffer overflow caused by lack of length validation on attacker-supplied encrypted_key in AES Key Wrap algorithms during JWE decryption, letting remote unauthenticated attackers cause heap corruption and denial of service, exploit requires crafted JWE input.

  • 7.5 /10 High
    CVE-2026-52482 No auth

    SJRC F11 SJ-GPS-PRO - Information Disclosure

    SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 contains an information disclosure vulnerability caused by inetd service spawning /app/sh_for_telnet, letting remote attackers obtain sensitive information, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-49315 No auth

    Input Device Module - Denial of Service

    An input device module contains a denial of service vulnerability caused by unspecified input handling issues, letting attackers disrupt availability, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-49314 No auth

    Rendering & Composition Module - Out of Bounds Write

    A rendering and composition module contains an out-of-bounds write vulnerability, letting attackers cause denial of service, exploit requires no special conditions.

  • 8.6 /10 High
    CVE-2026-49310

    Unknown Product - Broken Access Control

    An unspecified product contains a broken access control vulnerability in the event notification module, letting attackers affect service confidentiality, exploit requires unspecified conditions.

  • 9.8 /10 Critical
    CVE-2026-41871

    Apache Nutch - Unsafe Reflection

    Apache Nutch 1.10 through 1.22 contains an unsafe reflection vulnerability caused by use of externally-controlled input to select classes or code in Nutch Server (Nutch REST API), letting attackers bypass authorization, exploit requires access to Nutch Server.

  • 8.8 /10 High
    CVE-2026-41870 Auth required

    Apache Nutch - Code Injection

    Apache Nutch 1.11 through 1.22 contains a code injection and unsafe reflection vulnerability caused by missing authorization and improper control of dynamically-managed code in the Nutch REST API, letting attackers execute unauthorized code, exploit requires access to Nutch Server.

  • 9.1 /10 Critical
    CVE-2026-41869 No auth

    Apache Nutch - Broken Access Control

    Apache Nutch 1.10 through 1.22 contains missing authorization, improper resource shutdown, and job interruption vulnerabilities in the Nutch REST API, letting attackers cause service disruption and unauthorized access, exploit requires network access to the Nutch Service.

  • 9.8 /10 Critical
    CVE-2026-36433

    Actions Semiconductor Co. Ltd Tool- Media Player Utilities - Remote Code Execution

    Actions Semiconductor Co. Ltd Tool- Media Player Utilities v4.46 contains a remote code execution caused by vulnerabilities in Production.dll and RdiskUpgrade.exe components, letting physically proximate attackers execute arbitrary code.

  • 7.2 /10 High
    CVE-2026-26212 Auth required

    Rara One Click Demo Import - Unrestricted File Upload

    Rara One Click Demo Import plugin for WordPress < 1.3.5 contains an arbitrary file upload vulnerability caused by disabled file type validation in process_uploaded_files(), letting authenticated administrators upload and execute malicious PHP files remotely.

  • 7.2 /10 High
    CVE-2026-23855 Auth required

    Dell iDRAC - OS Command Injection

    Dell iDRAC9 14G < 7.00.00.184, 15G/16G < 7.30.10.50, and iDRAC10 17G < 1.30.30.50 contain an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands, exploit requires high privilege remote access.

  • 7.5 /10 High
    CVE-2026-22591 No auth

    eProsima Fast DDS - Denial of Service

    eProsima Fast DDS < 2.6.12, < 2.14.6, < 3.2.4, and < 3.4.3 contain a denial of service caused by a deeply nested filter expression in SQL-based content filtering (DDSSQLFilter), letting remote attackers crash participants by sending crafted SEDP DATA submessages, exploit requires network access to DDS domain.

  • 9.1 /10 Critical
    CVE-2026-22590 No auth

    eProsima Fast DDS - Out-of-Bounds Read

    eProsima Fast DDS < 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 contains an out-of-bounds read caused by improper validation of DATA_FRAG submessage payload length in CacheChange_t::add_fragments, letting remote attackers read adjacent heap memory, exploit requires crafted DATA_FRAG packets.

  • 7.1 /10 High
    CVE-2026-21100 Auth required

    SystemUI - Broken Access Control

    SystemUI prior to SMR Sep-2026 Release 1 contains an improper access control vulnerability caused by insufficient restrictions, letting local attackers launch arbitrary activities, exploit requires local access.