Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 891 of 891
- 7.8 /10 HighCVE-2026-28599 Auth required
ActivityManagerService - Intent Redirection Bypass
ActivityManagerService contains an intent redirection bypass caused by a logic error in addCreatorToken, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-28594 Auth required
Affected product - Privilege Escalation
Affected product contains a use after free caused by a logic error in multiple locations, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-28593 Auth required
SettingsFragment - Privilege Escalation
SettingsFragment contains a local privilege escalation caused by misleading or insufficient UI in getItemList, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-28590 Auth required
Generic Product - Authentication Bypass
Affected product contains an improper encryption key validation caused by a logic error in multiple locations, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-28583 Auth required
camera_metadata.c - Out of Bounds Write
camera_metadata.c contains an out of bounds write caused by a logical error in validate_camera_metadata_structure, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-28572 Auth required
InstallLaunch.kt - Clickjacking
InstallLaunch.kt contains a tapjacking vulnerability caused by misleading UI due to overlay attack, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.
- 7.4 /10 HighCVE-2026-19651 No auth
IBM Enterprise Build of Quarkus - Authorization Bypass
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 contains an authorization bypass caused by incorrect mapping of values to untrusted URL query parameters, letting attackers bypass authorization, exploit requires crafted URL query parameters.
- 9.9 /10 CriticalCVE-2026-19232 Auth required
Adobe Experience Manager - Broken Access Control
Adobe Experience Manager contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, potentially gaining elevated access or control over victim accounts, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-0084 Auth required
HostEmulationManager - Privilege Escalation
HostEmulationManager contains a logic error in multiple functions causing possible background activity launch, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.
- 7.8 /10 HighCVE-2026-0065 Auth required
BackgroundLaunchProcessController - Privilege Escalation
BackgroundLaunchProcessController contains a logic error in areBackgroundActivityStartsAllowed method, letting local users escalate privileges by launching activities in the background, exploit requires user execution privileges.