Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 156 of 681
- 7.5 /10 HighCVE-2026-109426
Telegram-Stremio - Authentication Bypass
Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability caused by reversible encoding of Telegram session strings without encryption, letting attackers with database or backup access recover authenticated sessions, exploit requires access to MongoDB database, backups, or logs.
- 7.4 /10 HighCVE-2026-109423
NetEase Cloud Music - Man-in-the-Middle
NetEase Cloud Music client for Windows 3.1.38 and 3.1.39.205426 contains a man-in-the-middle vulnerability caused by improper TLS certificate validation, letting network-adjacent attackers intercept and modify HTTPS traffic, exploit requires network adjacency.
- 8.1 /10 HighCVE-2026-109422
NetEase Cloud Music - Remote Code Execution
NetEase Cloud Music client for Windows 3.1.38 and 3.1.39.205426 contains a remote code execution caused by unvalidated URL scheme in renderer-process IPC bridge os.navigateExternal, letting attackers execute arbitrary local binaries under the logged-in user's account, exploit requires injecting content into the renderer via forged API response.
- 8.1 /10 HighCVE-2026-109399
SWUpdate - Authentication Bypass
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability caused by trusting untrusted X.509 certificates embedded in CMS SignedData, letting attackers with a sibling intermediate signing key install malicious updates, exploit requires attacker to hold a signing key from a sibling intermediate.
- 7.5 /10 HighCVE-2026-109398 No auth
Gumlet php-image-resize - Denial of Service
Gumlet php-image-resize < 3.0.1 contains a denial of service caused by lack of pixel limits in ImageResize constructor passing images to GD imagecreatefrom* functions, letting remote attackers exhaust PHP memory, exploit requires image upload.
- 7.2 /10 HighCVE-2026-109397 Auth required
Thelia - Unrestricted File Upload
Thelia < 3.1.2 and 3.2.x < 3.2.1 contain an unrestricted file upload vulnerability caused by inconsistent filename sanitization in FileProcessorService and FileManager::sanitizeFileName(), letting authenticated back-office users upload executable PHP files for code execution as the web server user.
- 7.4 /10 HighCVE-2026-109394 No auth
Thirty bees - Authentication Bypass
Thirty bees through 1.7.0 contains an authentication bypass caused by PasswordController::resolveCustomer() allowing unauthenticated attackers to reset registered customers' passwords using guest account tokens when guest checkout is enabled.
- 8.1 /10 HighCVE-2026-109391 No auth
Square Squash - Insecure Deserialization
Square Squash contains an insecure deserialization vulnerability caused by unsafe YAML.load usage in the /api/1.0/symbolication endpoint, letting unauthenticated attackers execute arbitrary code remotely, exploit requires crafted YAML payload.
- 9.8 /10 CriticalCVE-2026-109390 No auth
AnyDesk - Remote Code Execution
AnyDesk < 8.0.3 contains a heap-based buffer overflow caused by unvalidated payload length in the stream packet handler for mode 5 in the session protocol, letting unauthenticated remote attackers execute arbitrary code as root without victim approval.
- 7.5 /10 HighCVE-2026-109380 No auth
modern-tar - Denial of Service
modern-tar 0.3.5 through 0.8.5 contains a denial of service caused by memory exhaustion via negative entry sizes from non-octal bytes in readOctal(), letting attackers exhaust process memory by supplying crafted archives, exploit requires crafted archive input.
- 8.1 /10 HighCVE-2026-109373 No auth
ZITADEL - Authentication Bypass
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass caused by forging unsigned session cookies in the Login V2 UI, letting unauthenticated attackers obtain other users' session tokens and take over accounts, exploit requires no authentication.
- 8.7 /10 HighCVE-2026-109372 Auth required
ZITADEL - Authentication Bypass
ZITADEL 4.x < 4.19.2 and 3.x <= 3.4.15 contain an authentication bypass caused by improper assertion signature verification in the SAML identity-provider intent callback, letting attackers with organization-administrator permission authenticate as any user linked to another SAML provider, exploit requires organization-administrator privileges.
- 8.2 /10 HighCVE-2026-109371 No auth
ZITADEL - Authentication Bypass
ZITADEL < 4.18.0 contains a broken authentication vulnerability caused by the change-username handler acting on accounts before factor verification in hosted Login V1 UI, letting unauthenticated attackers rename active users including administrators.
- 7.5 /10 HighCVE-2026-109363 No auth
ZcashFoundation Zebra - Denial of Service
ZcashFoundation Zebra < 6.4.2 contains a denial of service caused by improper error handling during UnminedTx construction with pre-NU6.3 consensus branch ID transactions, letting unauthenticated peers crash the node remotely, exploit requires sending a crafted pre-handshake tx message.
- 7.3 /10 HighCVE-2026-109361
MONAI - Insecure Deserialization
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability caused by unpickling the postprocessing_file path from inference_information.json without confinement, letting attackers who can modify this file execute code remotely, exploit requires attacker to modify inference_information.json.