Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 772 of 891
- 9.9 /10 CriticalCVE-2026-90608 Auth required
Totolink A3002MU - Buffer Overflow
Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "service_type" argument in /boafrm/formPortFw component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-90607 Auth required
Totolink A3002MU - Buffer Overflow
Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formNewSchedule component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-90606 Auth required
Totolink A3002MU - Buffer Overflow
Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "static_ipv6" argument in /boafrm/formIpv6Setup component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-90605 Auth required
Totolink A3002MU - Buffer Overflow
Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "ip6addr" argument in /boafrm/formFilter component boa, letting remote attackers cause memory corruption, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-89180 No auth
Thinking Software Technology EFence - SQL Injection
Thinking Software Technology EFence contains a sql injection caused by improper input sanitization, letting unauthenticated remote attackers inject arbitrary SQL commands to read database contents, exploit requires no special privileges.
- 8.6 /10 HighCVE-2026-89023 No auth
ThemeAtelier Domain For Sale - Broken Access Control
ThemeAtelier Domain For Sale plugin for WordPress < 3.5.2 contains a broken access control vulnerability in REST API endpoints, letting unauthenticated attackers access and manipulate protected resources, including offer records and bidder information.
- 7.1 /10 HighCVE-2026-8821 Auth required
Mattermost - Broken Access Control
Mattermost 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 contains a broken access control caused by failure to validate channel member-management permission during playbook run creation, letting authenticated channel members add arbitrary users to restricted channels via the run owner field, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-87802
Apache Syncope - Authentication Bypass
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an authentication bypass caused by improper verification of cryptographic signatures in OAuth 2.0 SRA configuration without JWKS URI, letting attackers forge JWTs to impersonate users and gain full access, exploit requires misconfigured OAuth 2.0 SRA without JWKS URI.
- 9.1 /10 CriticalCVE-2026-87785 No auth
Apache Syncope - Authentication Bypass
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an authentication bypass caused by JWKS settings disclosure in internal JWT authentication, letting attackers spoof user privileges after valid authentication.
- 7.5 /10 HighCVE-2026-87779 No auth
Apache Syncope - Information Disclosure
Apache Syncope 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an information disclosure vulnerability caused by logging padded AES keys of non-standard length, letting attackers access sensitive information, exploit requires access to logs.
- 7.8 /10 HighCVE-2026-86917 Auth required
Apple macOS - Privilege Escalation
Apple macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 contain a privilege escalation caused by insufficient permission restrictions, letting apps gain root privileges, exploit requires app execution.
- 7.5 /10 HighCVE-2026-86904 No auth
Apple iOS & iPadOS - Privacy Violation
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and watchOS 27 contain a privacy issue caused by improper state management, letting apps track users across apps and websites without permission, exploit requires malicious app installation.
- 7.1 /10 HighCVE-2026-86901 Auth required
Apple macOS - Out of Bounds Write
Apple macOS Golden Gate 27 contains an out-of-bounds write caused by insufficient bounds checking when mounting a maliciously crafted exFAT volume, letting attackers cause system termination or kernel memory disclosure, exploit requires mounting the crafted volume.
- 7.5 /10 HighCVE-2026-86895 No auth
Apple - Information Disclosure
Apple iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 contain an information disclosure caused by improper state management, letting local apps read persistent account identifiers, exploit requires local app access.
- 7.5 /10 HighCVE-2026-86894 No auth
Apple macOS Golden Gate - Sandbox Escape
Apple macOS Golden Gate 27 contains a sandbox escape caused by a logic issue due to insufficient checks, letting applications break out of their sandbox, exploit requires app execution within sandbox.