Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 859 of 891
- 7.3 /10 HighCVE-2026-78627 Auth required
Okta Hyperdrive Integration - Information Disclosure
Okta Hyperdrive Integration installer contains an information disclosure vulnerability caused by OAuth client secret being logged in plaintext in installer logs and process command line, letting authenticated local users access sensitive credentials, exploit requires local authentication.
- 8.1 /10 HighCVE-2026-78626 Auth required
Okta Access Gateway - Authorization Bypass
Okta Access Gateway contains an authorization bypass caused by improper input sanitization and regex evaluation in Protected Rule authorization checks, letting attackers bypass authorization when Protected Rule policies are configured.
- 7.7 /10 HighCVE-2026-78623
Okta Access Gateway - SQL Injection
Okta Access Gateway contains a SQL injection caused by unsanitized SAML assertion values interpolated into database queries in advanced mode datastore configuration, letting attackers execute unintended SQL commands, exploit requires advanced mode datastore configuration.
- 7.5 /10 HighCVE-2026-78574 Auth required
Okta Hyperdrive Integration - Unrestricted File Upload
Okta Hyperdrive Integration plugin contains an insecure assembly loading vulnerability caused by loading assemblies from a registry path without integrity or signature verification, letting attackers execute unverified code in the host process or elevated installer context, exploit requires attacker control over registry entries.
- 8.8 /10 HighCVE-2026-78526 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-78525 No auth
Microsoft Office Outlook - Remote Code Execution
Microsoft Office Outlook contains a use after free vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-78524 No auth
Microsoft Office - Remote Code Execution
Microsoft Office contains an out-of-bounds write vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-78521 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-78519 No auth
Microsoft Office Outlook - Remote Code Execution
Microsoft Office Outlook contains a remote code execution caused by use of uninitialized resource, letting unauthorized attackers execute code over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-78518 No auth
Microsoft Office Excel - Remote Code Execution
Microsoft Office Excel contains an out-of-bounds read vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-78517 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.8 /10 HighCVE-2026-78514 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a use after free vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 8.8 /10 HighCVE-2026-78512 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a numeric truncation error that allows an unauthorized attacker to execute code over a network, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-78511 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 8.4 /10 HighCVE-2026-78510 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.