Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 735 of 767
- 7.8 /10 HighCVE-2026-79907 No auth
Acrobat Reader - Remote Code Execution
Acrobat Reader contains a double free vulnerability caused by improper memory management, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 8.8 /10 HighCVE-2026-78834 Auth required
CMSimple - Remote Code Execution
CMSimple 5.22 contains a server-side code execution caused by crafted external or uploaded text content in the CoAuthors plugin content import feature, letting authenticated low-privileged users execute code on the server, exploit requires low-privileged user authentication with content modification rights.
- 7.3 /10 HighCVE-2026-78627 Auth required
Okta Hyperdrive Integration - Information Disclosure
Okta Hyperdrive Integration installer contains an information disclosure vulnerability caused by OAuth client secret being logged in plaintext in installer logs and process command line, letting authenticated local users access sensitive credentials, exploit requires local authentication.
- 8.1 /10 HighCVE-2026-78626 Auth required
Okta Access Gateway - Authorization Bypass
Okta Access Gateway contains an authorization bypass caused by improper input sanitization and regex evaluation in Protected Rule authorization checks, letting attackers bypass authorization when Protected Rule policies are configured.
- 7.7 /10 HighCVE-2026-78623
Okta Access Gateway - SQL Injection
Okta Access Gateway contains a SQL injection caused by unsanitized SAML assertion values interpolated into database queries in advanced mode datastore configuration, letting attackers execute unintended SQL commands, exploit requires advanced mode datastore configuration.
- 7.5 /10 HighCVE-2026-78574 Auth required
Okta Hyperdrive Integration - Unrestricted File Upload
Okta Hyperdrive Integration plugin contains an insecure assembly loading vulnerability caused by loading assemblies from a registry path without integrity or signature verification, letting attackers execute unverified code in the host process or elevated installer context, exploit requires attacker control over registry entries.
- 8.8 /10 HighCVE-2026-78526 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-78525 No auth
Microsoft Office Outlook - Remote Code Execution
Microsoft Office Outlook contains a use after free vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-78524 No auth
Microsoft Office - Remote Code Execution
Microsoft Office contains an out-of-bounds write vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-78521 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-78519 No auth
Microsoft Office Outlook - Remote Code Execution
Microsoft Office Outlook contains a remote code execution caused by use of uninitialized resource, letting unauthorized attackers execute code over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-78518 No auth
Microsoft Office Excel - Remote Code Execution
Microsoft Office Excel contains an out-of-bounds read vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-78517 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-78514 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a use after free vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-78512 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a numeric truncation error that allows an unauthorized attacker to execute code over a network, exploit requires no special privileges.