Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 11 of 891
- 7.5 /10 HighCVE-2026-120062 Auth required
psqlODBC - SQL Injection
psqlODBC < 18.00.0006 contains a SQL injection caused by unescaped table and schema names in SQLSpecialColumns catalog query, letting attackers execute arbitrary SQL with connection privileges, exploit requires passing untrusted input.
- 7.5 /10 HighCVE-2026-120061 Auth required
psqlODBC - Buffer Overflow
psqlODBC before 18.00.0006 contains a buffer overflow caused by improper handling of ODBC escape sequences in SQL text, letting attackers cause memory corruption via crafted SQL queries, exploit requires untrusted SQL input.
- 7.5 /10 HighCVE-2026-120058 No auth
psqlODBC - Out of Bounds Read/Write
psqlODBC before 18.00.0006 contains a buffer overflow caused by inconsistent column count handling in FETCH replies with UseDeclareFetch enabled, letting untrusted servers write past allocated heap memory.
- 7.5 /10 HighCVE-2026-120057
psqlODBC - Buffer Overflow
psqlODBC < 18.00.0006 contains a buffer overflow caused by copying large-object read replies without buffer size validation, letting man-in-the-middle or untrusted servers overwrite adjacent memory, exploit requires fetching any large-object column.
- 7.8 /10 HighCVE-2026-119737 Auth required
Amlogic Android SDK pppoe_wrapper - Command Injection
Amlogic Android SDK pppoe_wrapper vendor daemon contains a command injection caused by unfiltered messages to a world-writable AF_UNIX socket, letting local attackers execute arbitrary commands as root, exploit requires local access.
- 8.2 /10 HighCVE-2026-119736 No auth
Attendo Admin Android - Hardcoded Credentials
Attendo Admin Android application <= 3.0.13 contains a hardcoded credentials vulnerability caused by embedded MQTT broker credentials in Flutter configuration files, letting attackers extract credentials and access sensitive messaging topics, exploit requires APK decompilation.
- 8.1 /10 HighCVE-2026-119733 Auth required
Munshi by Petpooja - Broken Access Control
Munshi by Petpooja before 2026-07-07 contains a broken access control caused by missing authorization checks in company deletion workflow at DELETE /api/companies/{company_id}, letting authenticated invited sub-users hard delete company records, exploit requires authenticated sub-user access to the company.
- 7.5 /10 HighCVE-2026-119731 No auth
Munshi (by Petpooja) - Authentication Bypass
Munshi (by Petpooja) before 2026-06-30 contains a payment bypass vulnerability caused by lack of webhook authentication and verification in subscription payment webhook at POST /api/payment/order/webhook, letting remote unauthenticated attackers mark subscriptions as paid without actual payment, exploit requires attacker to submit forged payment-success notifications referencing valid orders.
- 7.9 /10 HighCVE-2026-119301 Auth required
AWS SDK for pandas - SQL Injection
AWS SDK for pandas (awswrangler) 3.5.2 through 3.17.0 contains a SQL injection caused by improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component, letting authenticated remote users with permission to modify AWS Glue Data Catalog metadata read and write tables accessible by more privileged principals, exploit requires authenticated user with metadata modification permissions.
- 8.8 /10 HighCVE-2026-119085 Auth required
Amazon Virtual Engineering Workbench - Template Injection
Amazon Virtual Engineering Workbench contains a template injection caused by improper neutralization of special elements in the publishing component, letting remote authenticated attackers execute arbitrary code with publishing Lambda's IAM role permissions, exploit requires authentication.
- 8.2 /10 HighCVE-2026-117518 No auth
@fastify/reply-from - Path Traversal
@fastify/reply-from <= 12.8.0 contains a path traversal caused by improper validation of backslash dot-segments in proxy paths, letting unauthenticated attackers access unintended upstream resources, exploit requires crafted path with backslash dot-segments.
- 9.3 /10 CriticalCVE-2026-116769 No auth
Secure Access - Authentication Bypass
Secure Access servers >= 13.0 and < 14.61 contain an authentication bypass caused by improper validation, letting attackers modify client security settings via the server, exploit requires network access.
- 7.1 /10 HighCVE-2026-116768 Auth required
Secure Access - Denial of Service
Secure Access servers < 14.61 contain a denial of service caused by missing length validation, letting authenticated attackers cause persistent service disruption when connecting for the first time.
- 7.1 /10 HighCVE-2026-116767 Auth required
Secure Access - Denial of Service
Secure Access servers < 14.61 contain an improper input handling vulnerability, letting authenticated attackers cause persistent denial of service, exploit requires authentication.
- 8.3 /10 HighCVE-2026-116766 Auth required
Secure Access server - Denial of Service
Secure Access server >= 13.0 and < 14.61 contains an improper input handling vulnerability, letting attackers cause persistent denial of service, exploit requires crafted input.