Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 93 of 677

  • 8.3 /10 High
    CVE-2026-78557 No auth

    Industrial Edge App Publisher - Stored XSS & Remote Code Execution

    Industrial Edge App Publisher < V1.27.9 contains a stored XSS caused by improper sanitization of backend data in the user interface, letting attackers execute arbitrary JavaScript and achieve remote code execution on victim machines, exploit requires user interaction.

  • 7.4 /10 High
    CVE-2026-78556

    Industrial Edge App Publisher - Man-in-the-Middle

    Industrial Edge App Publisher < V1.27.9 contains a man-in-the-middle vulnerability caused by improper server certificate validation during TLS connection, letting attackers intercept and spoof communication, exploit requires network interception capability.

  • 7.8 /10 High
    CVE-2026-78459 Auth required

    Windows Internet Information Services - Privilege Escalation

    Windows Internet Information Services contains a heap-based buffer overflow caused by improper memory handling, letting authorized attackers elevate privileges locally, exploit requires local access with authorization.

  • 8.8 /10 High
    CVE-2026-77910 Auth required

    Microsoft Exchange Server - Broken Access Control

    Microsoft Exchange Server contains a broken access control vulnerability caused by incorrect authorization, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 8.8 /10 High
    CVE-2026-77902 No auth

    Microsoft Office Excel - Remote Code Execution

    Microsoft Office Excel contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-77496 No auth

    Windows Imaging Component - Remote Code Execution

    Windows Imaging Component contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-77459 Auth required

    Argo CD - Broken Access Control

    Argo CD 2.10.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contains a broken access control vulnerability caused by omission of AppProject destination and resource authorization checks in PostDelete resource hooks, letting users with write access to an Application's Git repository create unauthorized cluster-scoped or namespaced resources during deletion, exploit requires write access to the Application's Git repository.

  • 7.5 /10 High
    CVE-2026-77207 No auth

    Libreswan - Denial of Service

    Libreswan contains a null pointer dereference caused by inconsistent handling of PKCS#7 blobs in IKE certificate authentication, letting remote attackers cause a denial of service via crafted IKE_AUTH packets, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-77206 No auth

    Libreswan - Denial of Service

    Libreswan contains a null pointer dereference caused by a fall-through in the IKEv2 state machine EAP handling code, letting remote attackers cause a denial of service by sending a malicious IKE_AUTH packet, exploit requires no authentication.

  • 8.7 /10 High
    CVE-2026-77100 No auth

    Commvault MediaAgent - Denial of Service

    Commvault MediaAgent contains a heap-based buffer overflow causing service availability issues, letting attackers cause denial of service, exploit requires no special privileges.

  • 9.3 /10 Critical
    CVE-2026-77099 No auth

    CVFS - Command Injection

    CVFS contains a command injection caused by input validation issue, letting attackers execute arbitrary commands, exploit requires crafted input.

  • 7.7 /10 High
    CVE-2026-77096

    CVFS - Command Injection

    CVFS contains a command injection caused by missing authentication condition, letting attackers execute commands, exploit requires missing authentication condition.

  • 7.1 /10 High
    CVE-2026-77095 Auth required

    Commvault CvFWD - Denial of Service

    Commvault CvFWD contains a null pointer dereference causing service availability issues, letting attackers cause denial of service, exploit requires no special conditions.

  • 7.1 /10 High
    CVE-2026-77094 Auth required

    Commvault CvFWD - Denial of Service

    Commvault CvFWD contains an out-of-bounds write vulnerability causing service availability issues, letting attackers cause denial of service, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-77093 Auth required

    Commvault CvFWD - Denial of Service

    Commvault CvFWD contains an integer overflow causing service availability issues, letting attackers cause denial of service, exploit requires no special privileges.