Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 718 of 767

  • 8.8 /10 High
    CVE-2026-87433 No auth

    Google Chrome - Race Condition

    Google Chrome < 153.0.8010.36 contains a race condition in FileAPI, letting remote attackers who compromised the renderer process bypass site isolation via crafted HTML pages, exploit requires compromised renderer process.

  • 7.5 /10 High
    CVE-2026-87431 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 153.0.8010.36 contains a broken access control vulnerability caused by missing authorization in Extensions, letting remote attackers obtain sensitive information via crafted extensions, exploit requires crafted extension.

  • 8.8 /10 High
    CVE-2026-87430 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 153.0.8010.36 contains a buffer overflow in WebRTC caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 7.0 /10 High
    CVE-2026-87088 No auth

    Tanium Enforce - Remote Code Execution

    Tanium Enforce contains an unauthorized code execution vulnerability caused by improper access control, letting attackers execute code without authorization, exploit requires no special conditions.

  • 7.7 /10 High
    CVE-2026-87084 Auth required

    Tanium Enforce - Server Side Request Forgery

    Tanium Enforce contains a server-side request forgery caused by improper validation of URLs, letting attackers make arbitrary requests from the server, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-87075 Auth required

    Tanium Comply - Broken Access Control

    Tanium Comply contains an improper access control vulnerability caused by insufficient access restrictions, letting attackers access unauthorized resources, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-87072 Auth required

    Tanium Comply - Broken Access Control

    Tanium Comply contains an improper access control vulnerability caused by insufficient access restrictions, letting attackers access unauthorized resources, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-87036

    CVE-2026-87036

    Tanium addressed an improper access controls vulnerability in Comply.

  • 8.3 /10 High
    CVE-2026-87034 No auth

    Tanium Comply - SQL Injection

    Tanium Comply contains a sql injection vulnerability caused by unsanitized input in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 8.5 /10 High
    CVE-2026-87030 Auth required

    Tanium Comply - Path Traversal

    Tanium Comply contains a path traversal vulnerability, letting attackers access unauthorized files, exploit requires no special privileges.

  • 8.5 /10 High
    CVE-2026-87023 Auth required

    Tanium Comply - Path Traversal

    Tanium Comply contains a path traversal vulnerability, letting attackers access unauthorized file paths, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-87021

    Tanium Comply - Remote Code Execution

    Tanium Comply contains an unauthorized code execution vulnerability, letting attackers execute code without proper authorization, exploit requires unspecified conditions.

  • 8.1 /10 High
    CVE-2026-87016 PoC publicNo auth

    Open WebUI - Authentication Bypass

    Open WebUI 0.6.41 to 0.11.1 contains an authentication bypass caused by improper JSON matching compiled to SQL LIKE on SQLite, letting attackers impersonate administrator accounts, exploit requires crafted OAuth subject with wildcard characters.

  • 7.5 /10 High
    CVE-2026-87011 PoC public

    Open WebUI - Denial of Service

    Open WebUI 0.9.0 to 0.11.1 contains a denial of service caused by uncached network fetches and blocking signing-key lookup in the unauthenticated POST /oauth/backchannel-logout handler, letting remote attackers stall the single-worker instance and amplify traffic, exploit requires ENABLE_OAUTH_BACKCHANNEL_LOGOUT enabled.

  • 8.6 /10 High
    CVE-2026-86775 No auth

    knowns - Path Traversal

    knowns (npm package) <= 0.29.1 contains a path traversal vulnerability caused by improper sanitization of document paths in the Document API, letting remote unauthenticated attackers read, write, or delete arbitrary .md files, exploit requires unauthenticated access to Management API.