Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 785 of 891
- 7.8 /10 HighCVE-2026-43688 No auth
Apple iOS & iPadOS & macOS Golden Gate - Denial of Service
Apple iOS 27, iPadOS 27, and macOS Golden Gate 27 contain a memory corruption caused by insufficient input validation when processing maliciously crafted files, letting attackers cause denial of service, exploit requires crafted malicious file.
- 8.8 /10 HighCVE-2026-43686 No auth
Apple iOS & macOS - Use After Free
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a use-after-free vulnerability caused by improper memory management when connecting to a malicious NFS server, letting attackers cause kernel memory corruption, exploit requires connection to a malicious NFS server.
- 7.8 /10 HighCVE-2026-43684 Auth required
Apple iOS & macOS - Use After Free
Apple iOS 26.7, iPadOS 26.7, macOS Golden Gate 27, and macOS Sequoia 15.8 contain a use-after-free vulnerability caused by improper memory management, letting apps cause system termination or kernel memory corruption, exploit requires malicious app.
- 7.1 /10 HighCVE-2026-43683 Auth required
Apple macOS - Out of Bounds Read
Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain an out-of-bounds read caused by insufficient bounds checking, letting apps cause process termination or disclose process memory, exploit requires app execution.
- 7.5 /10 HighCVE-2026-33963 Auth required
Samsung Mobile Processor Exynos - Denial of Service
Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 contain a stack-based buffer overflow caused by malformed messages sent to the camera driver, letting attackers cause denial of service remotely, exploit requires sending malformed message.
- 7.7 /10 HighCVE-2026-31278 PoC publicAuth required
Suprema BioStar - Information Disclosure
Suprema BioStar 2 < 2.9.12 and BioStar X < 1.0.2 contain an information disclosure vulnerability caused by improper protection of Active Directory service account credentials in /api/v2/setting/adserversetting endpoint, letting attackers obtain credentials in cleartext via crafted GET request, exploit requires network access.
- 7.5 /10 HighCVE-2026-28960 No auth
Apple iOS & iPadOS - Denial of Service
Apple iOS and iPadOS < 18.7.10 contain a denial-of-service caused by insufficient validation, letting remote attackers cause service disruption, exploit requires crafted requests.
- 7.5 /10 HighCVE-2026-28938 No auth
Apple iOS & iPadOS - Information Disclosure
Apple iOS and iPadOS 26.6 contain an information disclosure vulnerability caused by improper handling of sensitive data, letting apps fingerprint users, exploit requires app installation.
- 7.5 /10 HighCVE-2026-28935 No auth
Apple - Out of Bounds Read/Write
Apple iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27 contain a memory corruption vulnerability caused by improper memory handling, letting apps cause system termination or kernel memory corruption, exploit requires malicious app execution.
- 8.1 /10 HighCVE-2026-25687 No auth
Zscaler Client Connector - Race Condition
Zscaler Client Connector contains a race condition in the ZPA tunnel handler causing heap corruption, letting attackers cause denial of service or execute arbitrary code, exploit requires no special conditions.
- 7.8 /10 HighCVE-2026-23789
Samsung Exynos - Use After Free
Samsung Mobile Processor and Wearable Processor Exynos series contain a double-free vulnerability caused by improper cleanup of dma_buf references in the Exynos MFC encoder driver, letting attackers cause kernel memory corruption and potentially execute arbitrary code, exploit requires kernel-level access.
- 7.1 /10 HighCVE-2026-20683 No auth
Apple - Authentication Bypass
Apple iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27 contain an authentication bypass caused by improper state management in the Sign In With Apple flow, letting apps access user Apple Accounts, exploit requires app to use the Sign In With Apple authentication flow.
- 9.8 /10 CriticalCVE-2026-20353
CVE-2026-20353
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20353 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.
- 7.1 /10 HighCVE-2026-19816 Auth required
PackageKit - Broken Access Control
PackageKit with dnf5 backend contains a broken access control vulnerability caused by improper polkit authorization check skipping for SIMULATE flag in RepoRemove handler, letting unprivileged local users uninstall packages, exploit requires local access.
- 7.8 /10 HighCVE-2026-19624 Auth required
NetworkManager-l2tp - Command Injection
NetworkManager-l2tp contains a command injection caused by unescaped attacker-controlled VPN connection properties in ipsec.conf, letting local unprivileged users escalate privileges to root via crafted L2TP VPN profiles.