Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 724 of 767

  • 9.8 /10 Critical
    CVE-2026-41871

    Apache Nutch - Unsafe Reflection

    Apache Nutch 1.10 through 1.22 contains an unsafe reflection vulnerability caused by use of externally-controlled input to select classes or code in Nutch Server (Nutch REST API), letting attackers bypass authorization, exploit requires access to Nutch Server.

  • 8.8 /10 High
    CVE-2026-41870 Auth required

    Apache Nutch - Code Injection

    Apache Nutch 1.11 through 1.22 contains a code injection and unsafe reflection vulnerability caused by missing authorization and improper control of dynamically-managed code in the Nutch REST API, letting attackers execute unauthorized code, exploit requires access to Nutch Server.

  • 9.1 /10 Critical
    CVE-2026-41869 No auth

    Apache Nutch - Broken Access Control

    Apache Nutch 1.10 through 1.22 contains missing authorization, improper resource shutdown, and job interruption vulnerabilities in the Nutch REST API, letting attackers cause service disruption and unauthorized access, exploit requires network access to the Nutch Service.

  • 9.8 /10 Critical
    CVE-2026-36433

    Actions Semiconductor Co. Ltd Tool- Media Player Utilities - Remote Code Execution

    Actions Semiconductor Co. Ltd Tool- Media Player Utilities v4.46 contains a remote code execution caused by vulnerabilities in Production.dll and RdiskUpgrade.exe components, letting physically proximate attackers execute arbitrary code.

  • 7.2 /10 High
    CVE-2026-26212 Auth required

    Rara One Click Demo Import - Unrestricted File Upload

    Rara One Click Demo Import plugin for WordPress < 1.3.5 contains an arbitrary file upload vulnerability caused by disabled file type validation in process_uploaded_files(), letting authenticated administrators upload and execute malicious PHP files remotely.

  • 7.2 /10 High
    CVE-2026-23855 Auth required

    Dell iDRAC - OS Command Injection

    Dell iDRAC9 14G < 7.00.00.184, 15G/16G < 7.30.10.50, and iDRAC10 17G < 1.30.30.50 contain an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands, exploit requires high privilege remote access.

  • 7.5 /10 High
    CVE-2026-22591 No auth

    eProsima Fast DDS - Denial of Service

    eProsima Fast DDS < 2.6.12, < 2.14.6, < 3.2.4, and < 3.4.3 contain a denial of service caused by a deeply nested filter expression in SQL-based content filtering (DDSSQLFilter), letting remote attackers crash participants by sending crafted SEDP DATA submessages, exploit requires network access to DDS domain.

  • 9.1 /10 Critical
    CVE-2026-22590 No auth

    eProsima Fast DDS - Out-of-Bounds Read

    eProsima Fast DDS < 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 contains an out-of-bounds read caused by improper validation of DATA_FRAG submessage payload length in CacheChange_t::add_fragments, letting remote attackers read adjacent heap memory, exploit requires crafted DATA_FRAG packets.

  • 7.1 /10 High
    CVE-2026-21100 Auth required

    SystemUI - Broken Access Control

    SystemUI prior to SMR Sep-2026 Release 1 contains an improper access control vulnerability caused by insufficient restrictions, letting local attackers launch arbitrary activities, exploit requires local access.

  • 9.8 /10 Critical
    CVE-2026-21096 PoC publicNo auth

    libimagecodec.quram.so - Remote Code Execution

    libimagecodec.quram.so prior to SMR Sep-2026 Release 1 contains a heap-based buffer overflow in JPEG decoder, letting remote attackers execute arbitrary code remotely, exploit requires crafted JPEG input.

  • 9.8 /10 Critical
    CVE-2026-21095 No auth

    libimagecodec.quram.so - Buffer Overflow

    libimagecodec.quram.so < SMR Sep-2026 Release 1 contains a heap-based buffer overflow in DNG decoder, letting remote attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-21094 No auth

    wpa_supplicant - Buffer Overflow

    wpa_supplicant prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation, letting adjacent attackers write out-of-bounds memory remotely, exploit requires network adjacency.

  • 7.8 /10 High
    CVE-2026-21091

    libcodec2secevrcdec.so - Out of Bounds Write

    libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 contains an out-of-bounds write caused by improper memory handling, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21090

    libsaviextractor.so - Out-of-Bounds Write

    libsaviextractor.so prior to SMR Sep-2026 Release 1 contains an out-of-bounds write caused by improper memory handling, letting local attackers write out-of-bounds memory, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-21089 Auth required

    libsubextractor.so - Buffer Overflow

    libsubextractor.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation in removing style tag, letting local attackers write out-of-bounds memory, exploit requires local access.