Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 723 of 767

  • 7.8 /10 High
    CVE-2026-71613 No auth

    GPAC - Buffer Overflow

    GPAC contains a buffer overflow caused by improper handling in the j2kdec_process() function, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.4 /10 High
    CVE-2026-71612 No auth

    GPAC - Buffer Overflow

    GPAC contains a buffer overflow caused by improper handling in the nhntdmx_process() function, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-67401 PoC publicAuth required

    cPanel - SQL Injection

    cPanel contains a SQL injection caused by improper input sanitization in the EmailTrack component, letting mail-enabled accounts achieve remote code execution as root, exploit requires mail-enabled account access.

  • 8.1 /10 High
    CVE-2026-65181 Auth required

    Impala - Remote Code Execution

    Impala 2.7-4.5 contains a remote code execution caused by insufficient authorization of Data Source tables, letting clients with upload privileges execute arbitrary Java code remotely, exploit requires upload privileges.

  • 8.2 /10 High
    CVE-2026-6485

    UEFI BIOS - Authentication Bypass

    UEFI BIOS embedded Shell contains a Secure Boot bypass caused by shell commands or startup scripts, letting attackers bypass Secure Boot protections, exploit requires access to the embedded shell.

  • 8.8 /10 High
    CVE-2026-57866 Auth required

    Apache Impala - Server Side Request Forgery

    Apache Impala 4.4.x and 4.5.x contain a server side request forgery caused by improper access control in ai_generate_text() function, letting authenticated users exfiltrate secrets from credential providers, exploit requires known secret keys.

  • 7.0 /10 High
    CVE-2026-56711 No auth

    VLC media player - Integer Overflow

    VLC media player contains an integer overflow in AllocatePicture due to 32-bit arithmetic on picture buffer size calculation, letting remote attackers cause out-of-bounds write via crafted PNG with large dimensions, exploit requires opening the file.

  • 9.8 /10 Critical
    CVE-2026-56207

    Apache Impala - Authentication Bypass

    Apache Impala >=4.0.0 contains a broken authentication caused by lack of signature verification of Bearer token in the last step of SAML2 authentication for hs2-http interface, letting attackers alter user names and impersonate other users, exploit requires crafted Bearer token.

  • 9.6 /10 Critical
    CVE-2026-54694 No auth

    SkillTree - Stored XSS & CSRF Token Theft

    SkillTree < 4.4.2 contains a stored XSS caused by unsanitized user input in account registration fields and unsafe HTML rendering in StringHighlighter.js and HighlightedValue.vue, letting attackers execute arbitrary scripts in admin browsers, exploit requires attacker to self-register with crafted input.

  • 9.1 /10 Critical
    CVE-2026-53939 No auth

    OpenIDC cjose - Cryptographic Key Generation Flaw

    OpenIDC cjose 0.6.1 through 0.6.2.5 contains a cryptographic key generation flaw caused by zeroed content-encryption key in AES-CBC-HMAC JWE encryption, letting attackers decrypt and forge JWE content, exploit requires use of affected algorithms.

  • 8.2 /10 High
    CVE-2026-53938 No auth

    OpenIDC cjose - Out of Bounds Read/Write

    OpenIDC cjose < 0.6.2.5 contains a buffer overflow caused by lack of length validation on attacker-supplied encrypted_key in AES Key Wrap algorithms during JWE decryption, letting remote unauthenticated attackers cause heap corruption and denial of service, exploit requires crafted JWE input.

  • 7.5 /10 High
    CVE-2026-52482 No auth

    SJRC F11 SJ-GPS-PRO - Information Disclosure

    SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 contains an information disclosure vulnerability caused by inetd service spawning /app/sh_for_telnet, letting remote attackers obtain sensitive information, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-49315 No auth

    Input Device Module - Denial of Service

    An input device module contains a denial of service vulnerability caused by unspecified input handling issues, letting attackers disrupt availability, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-49314 No auth

    Rendering & Composition Module - Out of Bounds Write

    A rendering and composition module contains an out-of-bounds write vulnerability, letting attackers cause denial of service, exploit requires no special conditions.

  • 8.6 /10 High
    CVE-2026-49310

    Unknown Product - Broken Access Control

    An unspecified product contains a broken access control vulnerability in the event notification module, letting attackers affect service confidentiality, exploit requires unspecified conditions.