Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 691 of 695

  • 7.5 /10 High
    CVE-2026-66304 No auth

    Skype for Business - Server Side Request Forgery

    Skype for Business contains a server-side request forgery caused by improper validation of URLs, letting unauthorized attackers disclose information over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-66302 No auth

    Skype for Business - Remote Code Execution

    Skype for Business contains an external control of file name or path vulnerability, letting unauthorized attackers execute code over a network, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-58941 Auth required

    iommu.c - Privilege Escalation

    iommu.c contains an out of bounds read/write caused by improper input validation in multiple functions, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-58874 Auth required

    SmsController - Broken Access Control

    SmsController.java contains a broken access control vulnerability caused by missing permission checks in multiple functions, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.0 /10 High
    CVE-2026-58848 Auth required

    alloc.c - Race Condition

    alloc.c contains a race condition causing unauthorized read/write access, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-58846 Auth required

    KVM - Use After Free

    KVM contains a use after free vulnerability caused by a missing permission check in kvm_iommu_map_sg of iommu.c, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-58839 Auth required

    MountRegistry - Buffer Overflow

    MountRegistry contains a buffer overflow caused by out of bounds read in forEachLine function, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-58823 Auth required

    stpropnci - Privilege Escalation

    stpropnci_process_std in stpropnci_std.cc contains a memory safety issue caused by a missing bounds check, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 9.8 /10 Critical
    CVE-2026-58822 No auth

    ftsmooth.c - Memory Safety

    ftsmooth.c contains a memory safety issue caused by improper casting in multiple functions, letting remote attackers execute arbitrary code without additional privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-58820 Auth required

    Generic Software - Integer Overflow

    Affected software contains an integer overflow vulnerability in multiple locations, letting local attackers escalate privileges without needing additional execution rights, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-55294 Auth required

    ihevcd_get_tu_data_size - Buffer Overflow

    ihevcd_get_tu_data_size in ihevcd_utils.c contains a heap buffer overflow caused by an out of bounds write, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-55285 Auth required

    Unspecified Product - Privilege Escalation

    An unspecified product contains an out-of-bounds write caused by missing bounds check in openLogicalChannel, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.0 /10 High
    CVE-2026-55277 Auth required

    RoutingManager - Remote Code Execution

    RoutingManager contains an out of bounds write caused by missing bounds check in checkUiccListenConfigNeeded, letting remote proximal attackers execute code without additional privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-55273 Auth required

    AnnotationProcessor - Privilege Escalation

    AnnotationProcessor.cpp contains a local privilege escalation caused by improper input validation in AppendCommentLine, letting attackers escalate privileges locally without additional execution rights, exploit requires no user interaction.

  • 9.0 /10 Critical
    CVE-2026-53581 Auth required

    OPNsense - Path Traversal

    OPNsense < 26.1.9 (opnsense/core) and < 26.4_20 (BE/opnsense/core) contain a path traversal caused by manipulation of GPS or PPS serial port parameters in the NTP configuration module, letting attackers with NTP config access overwrite arbitrary files as root.