Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 7 of 677

  • 8.8 /10 High
    CVE-2026-108428 No auth

    Microsoft Office Word - Remote Code Execution

    Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-108427 No auth

    Microsoft Office Word - Remote Code Execution

    Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-108426 No auth

    Microsoft Office Word - Remote Code Execution

    Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-108440 No auth

    Microsoft Office Word - Buffer Overflow

    Microsoft Office Word contains a stack-based buffer overflow caused by improper handling of input, letting unauthorized attackers execute code remotely over a network, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-108448 No auth

    Microsoft Office Outlook - Remote Code Execution

    Microsoft Office Outlook contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-108446 No auth

    Microsoft Office Excel - Remote Code Execution

    Microsoft Office Excel contains a use after free vulnerability that allows unauthorized attackers to execute code over a network, exploit requires network access.

  • 7.4 /10 High
    CVE-2026-111356 No auth

    MacCMS - Authentication Bypass

    MacCMS v10 through 2026.1000.4056 contains a broken authentication caused by unlimited attempts on six-digit password recovery code, letting unauthenticated attackers take over member accounts via brute-force, exploit requires knowledge of victim's email or phone.

  • 8.3 /10 High
    CVE-2026-77470 No auth

    Lychee - Broken Access Control

    Lychee < 7.7.1 contains a broken access control vulnerability caused by unrestricted additional_data array merging in the webshop checkout process, letting unauthenticated buyers manipulate payment parameters to underpay, exploit requires enabled webshop, purchasable item, and affected Omnipay gateway.

  • 8.2 /10 High
    CVE-2026-61838 No auth

    Lychee - Authorization Bypass

    Lychee < 7.6.3 contains an authorization bypass caused by missing access enforcement in album and photo archive downloads, letting unauthenticated attackers download protected album ZIP archives, exploit requires knowledge of shared album identifier.

  • 8.3 /10 High
    CVE-2026-77466 No auth

    Lychee - Authentication Bypass

    Lychee < 7.7.0 contains a broken authentication caused by insufficient validation of payment providers in CreateSessionRequest, letting buyers bypass payment and complete orders, exploit requires access to Supporter or Pro webshop with purchasable items enabled.

  • 7.5 /10 High
    CVE-2026-61611 No auth

    Lychee - Authentication Bypass

    Lychee < 7.6.1 contains a brute force vulnerability caused by lack of throttling and authentication checks in Album unlock API, letting remote unauthenticated attackers guess album passwords and access private photos.

  • 7.5 /10 High
    CVE-2026-95179 No auth

    lottie-android - Denial of Service

    lottie-android <= 6.7.1 contains a denial of service caused by a crafted Lottie animation JSON with cyclic precomposition references triggering uncontrolled recursion in BaseLayer.forModel and CompositionLayer, letting remote attackers cause DoS, exploit requires crafted animation JSON.

  • 7.5 /10 High
    CVE-2026-111160 No auth

    LightLLM - Denial of Service

    LightLLM through 1.2.0 contains a denial of service vulnerability caused by improper handling of the internal pd_kv_trans_params field in the /generate endpoint, letting unauthenticated attackers crash the inference worker, exploit requires sending a crafted request.

  • 7.5 /10 High
    CVE-2026-103936 No auth

    libp2p - Denial of Service

    libp2p < 6.0.28 contains a denial of service caused by unauthenticated STUN Binding Requests processed before authentication, letting remote attackers crash the process via crafted UDP packets, exploit requires network access.

  • 9.6 /10 Critical
    CVE-2026-57496 Auth required

    Labs64 NetLicensing MCP Server - Path Traversal

    Labs64 NetLicensing MCP Server < 0.1.8 contains a path traversal caused by lack of path-segment validation in product_number parameter, letting authenticated non-admin API key users retrieve plaintext tokens, exploit requires authenticated MCP client.