Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 9 of 677

  • 8.8 /10 High
    CVE-2026-110919 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.84 contains a use after free vulnerability in V8, caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110915 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.84 contains a use after free vulnerability in Compositing, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-110920 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.84 contains a memory corruption vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-110914 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.84 contains a memory corruption vulnerability in Workers, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110913 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.84 contains a memory corruption vulnerability in DOM, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-95155 No auth

    FasterXML Jackson - Denial of Service

    FasterXML Jackson 1.x including jackson-mapper-asl 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13 contains a denial of service caused by processing deeply nested JSON input in ObjectMapper.readValue, letting attackers cause application crash, exploit requires deserialization of untrusted JSON.

  • 9.9 /10 Critical
    CVE-2026-105037 Auth required

    EnergizeLab station-middleware - Path Traversal

    EnergizeLab station-middleware (NestJS) 1.6.5 through 1.8.2 contains a path traversal caused by insufficient validation of file paths, letting registered low-privilege attackers read arbitrary files from the server, exploit requires attacker to be logged in.

  • 9.6 /10 Critical
    CVE-2026-105039 Auth required

    EnergizeLab station-middleware - Broken Access Control

    EnergizeLab station-middleware (NestJS) 1.6.5 through 1.8.2 contains a broken access control caused by missing user role checks on administrative APIs, letting authenticated low-privilege users retrieve AI provider keys and modify configurations and object-store contents, exploit requires user authentication.

  • 8.2 /10 High
    CVE-2026-105034 No auth

    EnergizeLab Eilik NestJS - Authentication Bypass

    EnergizeLab Eilik NestJS auth service contains an authentication bypass caused by issuing device tokens for arbitrary robot serial numbers without authentication, letting unauthenticated remote attackers act as any device against cloud services.

  • 9.8 /10 Critical
    CVE-2026-105038 No auth

    EnergizeLab Eilik and EilikO FastAPI - Broken Access Control

    EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services contain a broken access control caused by unauthenticated exposure of AI model administration functions, letting unauthenticated remote attackers change AI model configuration and switch models at runtime.

  • 9.1 /10 Critical
    CVE-2026-105032 No auth

    EnergizeLab Eilik and EilikO - Path Traversal

    EnergizeLab Eilik and EilikO AI skill upload endpoint contains a path traversal vulnerability caused by lack of authentication and file path constraints, letting unauthenticated remote attackers write arbitrary files and tamper AI skill files, exploit requires no authentication.

  • 8.2 /10 High
    CVE-2026-111282 No auth

    Driftregion iso14229 - Integer Overflow

    Driftregion iso14229 < 0.10.1 contains an integer overflow caused by improper file path length check in Handle_0x38_RequestFileTransfer, letting unauthenticated attackers cause crashes or memory disclosure via crafted RequestFileTransfer requests.

  • 7.5 /10 High
    CVE-2026-111279 No auth

    Dragonfly - Denial of Service

    Dragonfly 2.0.2 contains an unbounded memory allocation vulnerability caused by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER, or SRANDMEMBER commands, letting unauthenticated clients cause denial of service by exhausting memory.

  • 8.6 /10 High
    CVE-2026-55103 No auth

    Discourse ActivityPub - Broken Access Control

    Discourse ActivityPub prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5 contains a broken access control vulnerability caused by insufficient verification of actor identity and ownership in inbound ActivityPub processing, letting remote attackers edit, delete, or reply to federated posts without permissions, exploit requires crafted signed requests.

  • 9.3 /10 Critical
    CVE-2026-99999 PoC publicNo auth

    Linux Kernel - Denial of Service

    Linux kernel contains a denial of service caused by improper validation of checksum_start in the ipv4 stack, letting attackers cause network header corruption, exploit requires sending malformed packets.