Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 768 of 891
- 8.5 /10 HighCVE-2026-11729 Auth required
IBM MQ - Insecure Deserialization
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an insecure deserialization vulnerability caused by unsafe deserialization enabling JNDI injection, letting authenticated attackers execute arbitrary code in client applications, exploit requires authentication.
- 8.1 /10 HighCVE-2026-11728 No auth
IBM MQ - Buffer Overflow
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a heap buffer overflow caused by improper handling of messages from malicious queue managers or man-in-the-middle attacks, letting remote attackers cause denial of service or execute arbitrary code in the client, exploit requires network access to the client.
- 7.8 /10 HighCVE-2026-10144 No auth
Rsbuild - Command Injection
Rsbuild < 2.0.9 contains a command injection caused by improper sanitization of shell metacharacters in URLs passed to server.open configuration on macOS, letting attackers execute arbitrary OS commands remotely, exploit requires crafted URL with shell metacharacters.
- 8.8 /10 HighCVE-2026-0200 Auth required
Cellular Modem - Privilege Escalation
Cellular Modem contains an out-of-bounds write caused by a heap buffer overflow, letting remote attackers escalate privileges without additional execution privileges, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-0199 Auth required
gf_ta_test - Buffer Overflow
gf_ta_test.c contains a buffer overflow caused by improper input validation in gf_ta_test_set_config, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 8.4 /10 HighCVE-2026-0194 No auth
Affected product - Privilege Escalation
Affected product contains a privilege escalation caused by an integer overflow in multiple locations, letting local attackers bypass permissions without additional execution privileges, exploit requires no user interaction.
- 8.4 /10 HighCVE-2026-0189 No auth
ac_init_policy - Permission Bypass
ac_init_policy contains a permission bypass caused by a logic error in init.c, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.
- 8.8 /10 HighCVE-2026-0171 Auth required
Unknown - Out of Bounds Write
Unknown product contains an out-of-bounds write caused by a logic error in multiple locations, letting remote attackers execute arbitrary code, exploit requires no special privileges or user interaction.
- 8.8 /10 HighCVE-2026-0170 Auth required
Vp9DecodeFrameTag - Privilege Escalation
Vp9DecodeFrameTag in vp9hwd_headers.cc contains an out-of-bounds write caused by missing bounds check, letting remote attackers escalate privileges without additional execution privileges, exploit requires no user interaction.
- 8.8 /10 HighCVE-2026-0159 Auth required
Cellular Modem - Remote Code Execution
Cellular Modem contains an out-of-bounds write caused by a missing bounds check, letting remote attackers execute arbitrary code without additional privileges, exploit requires no user interaction.
- 7.5 /10 HighCVE-2025-66974 No auth
Prolink 13A Smart Plug - Denial of Service & Connection Redirection
Prolink 13A Smart Plug Model DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 contains a denial of service caused by crafted packets during provisioning, letting attackers cause DoS or redirect connections to attacker devices, exploit requires crafted packet during provisioning.
- 9.8 /10 CriticalCVE-2024-58385 CISA KEVNo auth
Yonyou U8 CRM - SQL Injection
Yonyou U8 CRM contains an unauthenticated SQL injection caused by unsanitized 'id' parameter in fillbacksettingedit.php with DontCheckLogin=1 bypassing authentication, letting attackers execute arbitrary SQL and OS commands.
- 7.5 /10 HighCVE-2024-14029
Tornado - HTTP Request Smuggling
Tornado < 6.4.1 contains an HTTP request smuggling vulnerability caused by ignoring duplicate Transfer-Encoding: chunked headers, letting attackers perform request smuggling to bypass access control, poison cache, or desynchronize connections, exploit requires deployment behind proxies.
- 9.8 /10 CriticalCVE-2023-54398 CISA KEVNo auth
Yonyou U8 Cloud - Remote Code Execution
Yonyou U8 Cloud contains an unauthenticated insecure deserialization vulnerability in nc.impl.pub.filesystem.FileManageServlet, letting remote attackers execute arbitrary OS commands via crafted serialized payloads, exploit requires no authentication.
- 7.5 /10 HighCVE-2023-54397 No auth
Tornado - HTTP Request Smuggling
Tornado < 6.3.3 contains an HTTP request smuggling vulnerability caused by improper parsing of Content-Length headers accepting non-standard characters, letting attackers bypass proxy validation and smuggle requests, exploit requires deployment behind certain proxies.