Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 773 of 891
- 9.1 /10 CriticalCVE-2026-86881 PoC public
Apple - Authentication Bypass
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a certificate validation bypass caused by improper validation of intermediate certificate authorities, letting attackers with compromised intermediate CAs issue certificates with arbitrary extended key usages, exploit requires compromised intermediate CA.
- 7.2 /10 HighCVE-2026-86830 Auth required
AWS IAM Identity Center TEAM - Broken Access Control
AWS IAM Identity Center TEAM before 1.5.1 contains a broken access control caused by incorrect privilege assignment in Temporary Elevated Access Management, letting authenticated remote users read, approve, modify, or revoke arbitrary access requests, exploit requires application-level access.
- 9.8 /10 CriticalCVE-2026-86460 No auth
Apache Syncope - NoSQL Injection
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a cypher injection caused by improper handling of FIQL search conditions in the Neo4j persistence layer, letting attackers execute arbitrary queries, exploit requires crafted search conditions.
- 8.2 /10 HighCVE-2026-85921 Auth required
Windows Secure Kernel Mode - Privilege Escalation
Windows Secure Kernel Mode contains a double free vulnerability that allows an authorized attacker to elevate privileges locally, exploit requires local authorized access.
- 7.8 /10 HighCVE-2026-85892 Auth required
Microsoft Edge - Privilege Escalation
Microsoft Edge (Chromium-based) contains a race condition caused by concurrent execution using shared resources with improper synchronization, letting authorized attackers elevate privileges locally, exploit requires local access.
- 7.3 /10 HighCVE-2026-84632
Apple - Memory Corruption
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a memory corruption vulnerability caused by processing a maliciously crafted 3D model, letting attackers cause memory corruption, exploit requires processing of malicious 3D model.
- 7.8 /10 HighCVE-2026-84631 Auth required
Apple macOS Golden Gate - Privilege Escalation
Apple macOS Golden Gate contains a privilege escalation caused by insufficient entitlement checks, letting a local app gain root privileges, exploit requires local app execution.
- 7.5 /10 HighCVE-2026-84629 No auth
Apple iOS - Information Disclosure
Apple iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 contain an information disclosure vulnerability caused by insufficient entitlement checks, letting apps fingerprint users, exploit requires app installation.
- 9.1 /10 CriticalCVE-2026-84625 No auth
Apple - Broken Access Control
Apple iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27 contain a broken access control caused by insufficient sandbox restrictions, letting apps fingerprint users, exploit requires app installation.
- 7.5 /10 HighCVE-2026-84623 No auth
Apple iOS & iPadOS - Broken Access Control
Apple iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27 contain an authorization issue caused by improper state management, letting apps fingerprint the device, exploit requires app installation.
- 7.3 /10 HighCVE-2026-84620 Auth required
Apple - Integer Overflow
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain an integer overflow caused by improper input validation in 3D model processing, letting attackers cause memory corruption, exploit requires processing a maliciously crafted 3D model.
- 7.3 /10 HighCVE-2026-84611 Auth required
Apple - Out of Bounds Write
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain an out-of-bounds write caused by improper bounds checking in 3D model processing, letting attackers cause memory corruption, exploit requires processing a maliciously crafted 3D model.
- 9.8 /10 CriticalCVE-2026-84609 No auth
Apple - Broken Access Control
Apple iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a broken access control caused by insufficient path validation, letting apps modify protected system files, exploit requires app execution.
- 7.8 /10 HighCVE-2026-84607 Auth required
Apple - Race Condition
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a race condition caused by improper state management, letting sandboxed apps execute arbitrary code with kernel privileges, exploit requires sandboxed app execution.
- 7.5 /10 HighCVE-2026-84606 No auth
Apple iOS - Privacy Violation
Apple iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 contain a privacy issue caused by improper handling of identifiers, letting apps identify users across reinstalls, exploit requires app installation.