Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 779 of 891

  • 9.8 /10 Critical
    CVE-2026-73470 No auth

    Apache Syncope - Improper Privilege Management

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an improper privilege management vulnerability caused by delegation of roles outside the user's ownership or realm subtree, letting attackers escalate privileges, exploit requires delegation management permissions.

  • 9.8 /10 Critical
    CVE-2026-73370 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by incomplete delegated administration security checks in the Reconciliation service's pull and push, letting administrators without adequate entitlements perform unauthorized actions, exploit requires attacker to be an authenticated administrator.

  • 7.5 /10 High
    CVE-2026-73236 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by improper realm prefix matching in delegated administration, letting attackers gain unauthorized access, exploit requires crafted realm names.

  • 7.3 /10 High
    CVE-2026-73195 Auth required

    Apache Syncope - CSV Injection

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a CSV injection caused by improper encoding or escaping of output in CSV export, letting authenticated users execute spreadsheet formulas, exploit requires user authentication.

  • 7.5 /10 High
    CVE-2026-73178 No auth

    Apache Syncope - Information Disclosure & Privilege Escalation

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an information disclosure vulnerability caused by administrator access to signed JWT access tokens via REST, letting administrators impersonate higher privileged users, exploit requires administrator entitlements.

  • 8.8 /10 High
    CVE-2026-72524 Auth required

    Apache Doris - Broken Access Control

    Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3 contain a broken access control vulnerability caused by incorrect authorization logic, letting authenticated users bypass privilege checks to access or modify unauthorized data, exploit requires user authentication.

  • 7.4 /10 High
    CVE-2026-70658

    Pay - Authentication Bypass

    Pay for Ruby on Rails < 11.6.2 contains a timing attack vulnerability caused by insecure comparison of HMAC signatures in PaddleBillingController, letting unauthenticated remote attackers forge accepted webhooks, exploit requires precise timing measurements.

  • 7.8 /10 High
    CVE-2026-68955

    Rakuten Kobo Desktop Application - Remote Code Execution

    Rakuten Kobo Desktop Application (Windows version) contains a DLL hijacking vulnerability caused by insecure loading of Dynamic Link Libraries during installation, letting attackers execute arbitrary code with user privileges, exploit requires crafted DLL in installer directory.

  • 8.2 /10 High
    CVE-2026-65838

    Skipper - Authorization Bypass

    Skipper < 0.27.35 contains an authorization bypass caused by incomplete request body parsing in opaAuthorizeRequestWithBody filter, letting attackers bypass deny-on-presence Rego policies with oversized Content-Length requests, exploit requires policy logic that does not reject truncated bodies.

  • 8.1 /10 High
    CVE-2026-65415 No auth

    Apple - Race Condition

    Apple iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 contain a race condition caused by insufficient validation, letting local users cause system termination or read kernel memory, exploit requires local access.

  • 9.8 /10 Critical
    CVE-2026-65414 No auth

    Apple - Out of Bounds Write

    Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain an out-of-bounds write caused by insufficient bounds checking, letting remote attackers cause app termination or execute arbitrary code, exploit requires remote access.

  • 7.5 /10 High
    CVE-2026-65410 No auth

    Apple - Denial of Service

    Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a denial of service caused by insufficient checks, letting apps cause unexpected system termination, exploit requires app execution.

  • 7.8 /10 High
    CVE-2026-65398 Auth required

    Apple - Out of Bounds Read/Write

    Apple iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 contain an out-of-bounds read/write caused by insufficient bounds checking, letting apps cause system termination or kernel memory corruption, exploit requires malicious app.

  • 8.8 /10 High
    CVE-2026-65391 No auth

    Apple Safari - Out of Bounds Write

    Apple Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS contain an out-of-bounds write caused by insufficient bounds checking in web content processing, letting attackers cause memory corruption remotely, exploit requires crafted web content.

  • 8.8 /10 High
    CVE-2026-65390 No auth

    Apple Safari - Integer Overflow

    Apple Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS contain an integer overflow caused by insufficient input validation when processing web content, letting attackers cause memory corruption, exploit requires malicious web content.