Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 192 of 681
- 9.4 /10 CriticalCVE-2026-107806 PoC publicAuth required
Nginx UI - Command Injection
Nginx UI 2.3.8 to 2.5.0 contains a command injection caused by trusting attacker-controlled backup key material and manifest in /api/restore, letting authenticated administrators execute arbitrary commands, exploit requires active secure session.
- 7.5 /10 HighCVE-2026-107805 No auth
Nginx UI - Denial of Service
Nginx UI 2.5.0 to < 2.6.0 contains a denial of service caused by temporary file staging of attacker-controlled request body in node-signature authentication path, letting unauthenticated remote clients exhaust filesystem and processing resources, exploit requires API access with valid signature metadata.
- 7.3 /10 HighCVE-2026-106581 Auth required
Docker Desktop for Windows - Privilege Escalation
Docker Desktop for Windows < 4.92.0 contains a privilege escalation vulnerability caused by lack of signature verification in Docker Desktop Installer.exe install -package, letting attackers execute installer actions as LocalSystem, exploit requires user approval of UAC prompt.
- 8.9 /10 HighCVE-2026-106155 Auth required
In Progress Telerik Report Server - Stored XSS & Privilege Escalation
In Progress Telerik Report Server < 12.2.26.1007 contains a stored XSS caused by embedding javascript: or vbscript: URLs in report navigation or HTML text box links, letting authenticated report authors execute scripts in other users' sessions, exploit requires authenticated report author.
- 7.1 /10 HighCVE-2026-106145 Auth required
In Progress Telerik Report Server - Broken Access Control
In Progress Telerik Report Server < 12.2.26.1007 contains a broken access control caused by incorrect privilege assignment in the service-agent SignalR hub, letting authenticated low-privilege users escalate privileges to access protected secrets and impersonate agents, exploit requires valid bearer token.
- 7.1 /10 HighCVE-2026-105883 Auth required
ThemeHunk Th Shop Mania - Broken Access Control
ThemeHunk Th Shop Mania <= 1.9.1 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-105872 Auth required
mklacroix Product Configurator for WooCommerce - Insecure Deserialization
mklacroix Product Configurator for WooCommerce <= 1.7.5 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-105870 No auth
Delight Star Inc. WP Associate Post R2 - Reflected XSS
Delight Star Inc. WP Associate Post R2 <= 5.0.1 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.
- 7.1 /10 HighCVE-2026-105318 No auth
Datasolution AcyMailing SMTP Newsletter - Reflected XSS
Datasolution AcyMailing SMTP Newsletter <= 11.1.0 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-105281 No auth
openPDC - Information Disclosure
openPDC contains an information disclosure vulnerability caused by unauthenticated network connections to the internal data publisher, letting unauthenticated attackers retrieve complete device and measurement topology, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-105278
openPDC - Authentication Bypass
openPDC Docker image contains a broken authentication caused by fixed administrative credentials with no forced change on first use, letting attackers with network access gain full administrative control, exploit requires network access to management interface.
- 8.2 /10 HighCVE-2026-104635 No auth
elixir-protobuf protobuf - Denial of Service
elixir-protobuf protobuf >= 0.8.0 contains an uncontrolled recursion vulnerability caused by missing depth checks in Protobuf.JSON.Decode for self-referential or cyclic message types, letting unauthenticated remote attackers crash the decoding process via deeply nested JSON documents, exploit requires crafted deeply nested JSON input.
- 8.8 /10 HighCVE-2026-104629 Auth required
openPDC & openHistorian - Command Injection
openPDC and openHistorian contain a command injection caused by insecure component loading mechanism, letting authenticated attackers with file placement privileges execute arbitrary constructor code with service account privileges.
- 8.8 /10 HighCVE-2026-104392 Auth required
ExpressTech Quiz And Survey Master - Insecure Deserialization
ExpressTech Quiz And Survey Master <= 11.2.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-104084 Auth required
SmarterMail - Privilege Escalation
SmarterMail < 9777 contains a privilege escalation caused by JWT tokens embedding role claims that are not revalidated on refresh, letting attackers retain higher privileges by replaying stale tokens, exploit requires captured refresh token.