Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 205 of 695
- 9.3 /10 CriticalCVE-2026-107935 No auth
gvisor-tap-vsock gvproxy - Path Traversal
gvisor-tap-vsock gvproxy contains a path traversal caused by improper validation of socket path in /services/forwarder/expose endpoint, letting unauthenticated attackers delete arbitrary files on the host system, exploit requires no authentication.
- 7.8 /10 HighCVE-2026-107914 No auth
Backdrop CMS - Broken Access Control
Backdrop CMS 1.34 < 1.34.5 and 1.35 < 1.35.1 contain an information disclosure vulnerability caused by insufficient protection of configuration exports in compressed archives, letting attackers with specific permissions access sensitive configuration data, exploit requires prior export request with proper permissions.
- 7.5 /10 HighCVE-2026-107911 Auth required
FalkorDB - Denial of Service & Memory Corruption
FalkorDB < 4.20.0 contains a type confusion vulnerability caused by improper casting of Redis string objects to Bolt client structures in _read_flags function, letting remote authenticated attackers cause denial of service or memory corruption via GRAPH.QUERY, exploit requires authentication.
- 8.1 /10 HighCVE-2026-107910 No auth
FalkorDB - Authentication Bypass
FalkorDB < 4.20.0 contains an improper authentication vulnerability caused by incorrect handling of Redis AUTH command errors in is_authenticated function, letting remote unauthenticated attackers execute graph queries via the Bolt endpoint, exploit requires Bolt endpoint enabled.
- 9.1 /10 CriticalCVE-2026-107909 No auth
FalkorDB - Denial of Service
FalkorDB < 4.20.0 contains a heap-based out-of-bounds write caused by improper bounds checking in ws_read_frame and buffer_apply_mask functions, letting remote unauthenticated attackers cause denial of service and heap corruption by sending crafted WebSocket frames, exploit requires Bolt endpoint enabled.
- 9.8 /10 CriticalCVE-2026-107908 No auth
FalkorDB - Out of Bounds Read/Write
FalkorDB < 4.20.0 contains a heap-based out-of-bounds write caused by improper size validation in BoltReadHandler, letting remote unauthenticated attackers cause denial of service or execute arbitrary code via crafted Bolt RESET messages, exploit requires Bolt endpoint enabled.
- 7.1 /10 HighCVE-2026-107852 Auth required
Jexactyl - Broken Access Control
Jexactyl < 4.0.5 contains a broken access control vulnerability caused by improper validation of Stripe Checkout Session amount and currency in /api/client/billing/stripe/process, letting authenticated clients pay less or in mismatched currency to process orders.
- 9.3 /10 CriticalCVE-2026-107845 No auth
Contao - Stored XSS
Contao 4.0.0 to 5.3.50 and 5.7.12 contains a stored XSS caused by insufficient attribute and URL encoding in listComments() in comments-bundle/contao/dca/tl_comments.php, letting unauthenticated visitors execute scripts in backend user sessions, exploit requires backend user to open Comments module.
- 7.5 /10 HighCVE-2026-107840 No auth
Yopass - Denial of Service
Yopass < 14.7.0 contains a denial of service caused by unvalidated use of attacker-controlled HTTP method tokens in Prometheus metrics middleware, letting unauthenticated remote attackers cause memory exhaustion, exploit requires sending arbitrary HTTP methods.
- 7.5 /10 HighCVE-2026-107839 No auth
ageLANServer - Denial of Service
ageLANServer < 1.15.2 contains a denial of service caused by lack of request body size limit in AoE3 POST /game/cloud/getFileURL handler, letting remote unauthenticated clients crash or hang the server, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-107838
RIOT - Denial of Service
RIOT 2023.07 through 2026.07 contains a denial of service caused by ignoring failure from _resp_init() when coap_build_reply() cannot fit a response header, letting remote clients with large extended tokens terminate service, exploit requires nanocoap_token_ext enabled.
- 8.2 /10 HighCVE-2026-107837 No auth
RIOT - Out of Bounds Read
RIOT <= 2026.07 contains an out-of-bounds read caused by insufficient payload validation in _receive() leading to improper sixlowpan_frag_t handling, letting remote attackers cause memory disclosure and network stack crash, exploit requires sending malformed 6LoWPAN fragments.
- 7.1 /10 HighCVE-2026-107836
RIOT - Denial of Service
RIOT <= 2026.07 contains a denial of service caused by improper validation of Block2 response block size in nanocoap_sock_get_slice(), letting malicious CoAP servers crash the client and expose adjacent memory, exploit requires a malicious CoAP server.
- 7.5 /10 HighCVE-2026-107826 No auth
OWASP Coraza WAF - Denial of Service
OWASP Coraza WAF 3.0.0 to 3.8.1 contains a denial of service caused by unbounded recursion in readJSON during JSON validation, letting unauthenticated attackers crash the process via deeply nested JSON payloads.
- 9.3 /10 CriticalCVE-2026-107824
x64dbg-MCP Server - Remote Code Execution
x64dbg-MCP Server < 1.1 contains a remote code execution vulnerability caused by unauthenticated exposure of debugger tools over HTTP and SSE, letting unauthenticated network attackers execute arbitrary commands and write files, exploit requires network access to default ports.