Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 115 of 677
- 7.7 /10 HighCVE-2026-61642 Auth required
Squid - HTTP Request Smuggling
Squid 3.3.0.1 to before 7.6 contains an HTTP Request Smuggling vulnerability caused by improper enforcement of Transfer-Encoding header parsing in src/HttpHeader.cc, letting trusted clients bypass security and poison caches, exploit requires trusted client access.
- 8.8 /10 HighCVE-2026-59241 Auth required
SIMATIC WinCC - Privilege Escalation
SIMATIC WinCC V7.5 (All versions), V8.0 (< V8.0 Update 11), and V8.1 (< V8.1 Update 7) contain a privilege escalation caused by insufficient restriction of database role permissions, letting authenticated remote attackers with database access execute arbitrary commands on the host system.
- 7.5 /10 HighCVE-2026-58280 No auth
.NET - Denial of Service
.NET contains an uncontrolled recursion vulnerability that allows unauthorized attackers to cause denial of service over a network, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-58249 No auth
SAP NetWeaver & SAP Web Dispatcher - Denial of Service
SAP NetWeaver and SAP Web Dispatcher contain a denial of service vulnerability caused by improper validation of certain fields in specially crafted requests handled by an internal protocol component, letting unauthenticated attackers crash the affected process remotely, exploit requires no special privileges.
- 8.7 /10 HighCVE-2026-55823 Auth required
Frappe - SQL Injection
Frappe < 16.23.0 contains a SQL injection caused by unsanitized input in get_count() method in reportview, letting attackers alter SQL queries, exploit requires crafted report input.
- 9.1 /10 CriticalCVE-2026-55695 Auth required
FearlessCMS - Remote Code Execution
FearlessCMS <= 0.1.2b contains a command injection caused by unauthenticated Git repository URL setting in admin/updater-handler.php, letting authenticated administrators execute arbitrary PHP code with web server privileges, exploit requires admin authentication.
- 10.0 /10 CriticalCVE-2026-55675 No auth
Salty Documentation Repository - Secret Disclosure
Salty documentation repository prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 contains a secret disclosure vulnerability caused by executing attacker-controlled setup.py or PEP 517 build hooks in privileged workflows, letting attackers disclose secrets and compromise the system, exploit requires attacker control of fork content.
- 7.3 /10 HighCVE-2026-55601 Auth required
MultiTail - Command Injection
MultiTail <= 7.1.5 contains a command injection caused by insufficient escaping of shell metacharacters in the execute-on-match feature, letting attackers executing commands as the user running MultiTail, exploit requires attacker to control monitored input.
- 9.0 /10 CriticalCVE-2026-55562 Auth required
Cronicle - Stored XSS
Cronicle < 0.9.119 contains a stored XSS caused by improper encoding of attacker-controlled user full_name in Activity Log, letting authenticated or anonymous attackers execute scripts in administrator sessions, exploit requires admin to view Activity Log.
- 8.8 /10 HighCVE-2026-55376 Auth required
Heym - Command Injection
Heym < 0.0.40 contains a sandbox bypass caused by allowed standard-library modules exposing OS, process, and filesystem capabilities in python_tool_executor.py, letting authenticated users execute arbitrary code, exploit requires workflow creation or editing with Agent custom Python tool.
- 9.6 /10 CriticalCVE-2026-55183 No auth
RClone Manager - Cross-Site Request Forgery
RClone Manager < 0.2.7 contains a cross-site request forgery caused by unauthenticated local rclone rcd service with permissive CORS, letting malicious web pages access and modify user files and storage credentials, exploit requires user to open malicious web page.
- 7.7 /10 HighCVE-2026-54641 Auth required
OpenRemote - Broken Access Control
OpenRemote < 1.24.2 contains a broken access control caused by improper authorization checks in UserResourceImpl methods, letting realm administrators access other tenants' user data, breaking tenant isolation.
- 7.6 /10 HighCVE-2026-54640 Auth required
OpenRemote - XML External Entity Injection
OpenRemote < 1.24.2 contains an XML external entity injection caused by unsafe external entity resolution in KNXProtocol.startAssetImport method, letting authenticated users read files or cause server-side requests, exploit requires user authentication.
- 9.1 /10 CriticalCVE-2026-54454 Auth required
OpenCATS - Remote Code Execution
OpenCATS < 0.10.0 contains a remote code execution caused by improper handling of uploaded files in ImportUI.php, letting authenticated users with Import privileges execute arbitrary PHP code via web-accessible temporary directory, exploit requires Import privileges.
- 9.8 /10 CriticalCVE-2026-53709
MCP Context Forge - Authentication Bypass
MCP Context Forge < 1.0.2 contains a broken authentication caused by use of a known JWT_SECRET_KEY and platform-admin bootstrap, letting remote unauthenticated attackers mint administrator tokens, exploit requires vulnerable signing key and bootstrap enabled.