Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 634 of 677

  • 9.8 /10 Critical
    CVE-2026-21096 PoC publicNo auth

    libimagecodec.quram.so - Remote Code Execution

    libimagecodec.quram.so prior to SMR Sep-2026 Release 1 contains a heap-based buffer overflow in JPEG decoder, letting remote attackers execute arbitrary code remotely, exploit requires crafted JPEG input.

  • 9.8 /10 Critical
    CVE-2026-21095 No auth

    libimagecodec.quram.so - Buffer Overflow

    libimagecodec.quram.so < SMR Sep-2026 Release 1 contains a heap-based buffer overflow in DNG decoder, letting remote attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-21094 No auth

    wpa_supplicant - Buffer Overflow

    wpa_supplicant prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation, letting adjacent attackers write out-of-bounds memory remotely, exploit requires network adjacency.

  • 7.8 /10 High
    CVE-2026-21091

    libcodec2secevrcdec.so - Out of Bounds Write

    libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 contains an out-of-bounds write caused by improper memory handling, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21090

    libsaviextractor.so - Out-of-Bounds Write

    libsaviextractor.so prior to SMR Sep-2026 Release 1 contains an out-of-bounds write caused by improper memory handling, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21089 Auth required

    libsubextractor.so - Buffer Overflow

    libsubextractor.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation in removing style tag, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21088 Auth required

    libsubextractor.so - Buffer Overflow

    libsubextractor.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation in loading a subtitle frame, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21087 Auth required

    libmdnie.so - Buffer Overflow

    libmdnie.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by out-of-bounds write, letting local attackers execute arbitrary code with system server privileges, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21086 Auth required

    ProxyHandler - Broken Access Control

    ProxyHandler prior to SMR Aug-2026 Release 1 contains an improper authorization vulnerability caused by insufficient access control, letting local attackers access proxy configuration, exploit requires local access.

  • 7.5 /10 High
    CVE-2026-19201 No auth

    Google go-attestation - Denial of Service

    Google go-attestation <= 0.6.1 contains a denial of service caused by uncontrolled recursion in the Windows SIPA event log parser's readELAMAggregation function, letting attackers crash the verifier via crafted nested elamAggregation events, exploit requires crafted Windows event log input.

  • 8.1 /10 High
    CVE-2026-18147 No auth

    FreeIPA - Stored XSS

    FreeIPA contains a stored XSS caused by DOM manipulation in the Web UI password reset page, letting unauthenticated remote attackers execute arbitrary JavaScript via crafted links, exploit requires victim interaction.

  • 7.2 /10 High
    CVE-2026-17553 Auth required

    WP EasyCart - Privilege Escalation

    WP EasyCart <= 5.9.3 contains a privilege escalation caused by insecure update_option() calls in ec_ajax_save_page_default_options() AJAX handler, letting authenticated Store Manager-level users escalate to administrator by modifying WordPress options, exploit requires authenticated user with Store Manager or higher privileges.

  • 7.5 /10 High
    CVE-2026-16960 No auth

    Loops & Logic WordPress - Information Disclosure

    Loops & Logic WordPress plugin < 4.3.0 contains an information disclosure vulnerability caused by insufficient restriction on public template-data action, letting unauthenticated users read arbitrary user records and site options, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-16272 No auth

    PayTR Virtual Pos iFrame API WHMCS Module - Authentication Bypass

    PayTR Virtual Pos iFrame API (v9x) WHMCS Module >= 9.0.0 < 9.0.3 contains a use of less trusted source vulnerability caused by improper validation of trusted identifiers, letting attackers exploit trusted identifiers, exploit requires crafted requests.

  • 7.7 /10 High
    CVE-2026-15913 Auth required

    Fortra GoAnywhere MFT - Path Traversal

    Fortra GoAnywhere MFT < 7.10.2 contains a path traversal caused by improper validation in /attachRemoteFiles endpoint, letting web users with Secure Folders and Secure Mail permissions read arbitrary files outside their sandbox, exploit requires specific permissions.