Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 218 of 695
- 8.2 /10 HighCVE-2026-14496 No auth
IBM DataPower Gateway - Denial of Service
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a denial of service caused by a heap-based buffer overflow, letting remote attackers crash the system, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-14269 No auth
IBM DataPower Gateway - Remote Code Execution
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a remote code execution caused by heap-based buffer overflow due to improper bounds checking, letting unauthenticated remote attackers execute arbitrary code.
- 10.0 /10 CriticalCVE-2026-12260 No auth
NetBoard CRM - SQL Injection
NetBoard CRM demo platform contains a SQL injection caused by unsanitized 'user-name' POST parameter in /module/auth/recovery.php, letting attackers extract confidential information and alter data, exploit requires crafted POST requests.
- 7.8 /10 HighCVE-2026-11318 PoC publicAuth required
Deskin - Privilege Escalation
Deskin through 3.3.4.3 contains a privilege escalation caused by lack of authentication in the com.deskin.service.installer XPC service, letting local unprivileged attackers execute arbitrary installer packages as root, exploit requires local access.
- 7.1 /10 HighCVE-2026-107802
SumatraPDF - Command Injection
SumatraPDF <= 3.6.1 contains a command injection caused by incomplete quote-only escaping in translation text embedding in Windows command lines, letting attackers inject CLI flags when specific backends are used, exploit requires agentic CLI backend installation.
- 7.8 /10 HighCVE-2026-107782 Auth required
System Informer - Broken Access Control
System Informer < 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper, letting local attackers execute code as SYSTEM by connecting from any Authenticode-signed process.
- 7.4 /10 HighCVE-2026-107781 No auth
Dromara Skyeye - Server-Side Request Forgery & Broken Access Control
Dromara Skyeye contains a server-side request forgery and missing authorization vulnerability in OnlyOffice save callback editUploadOfficeFileById, letting unauthenticated attackers fetch internal URLs and overwrite user files, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-107780 No auth
Dromara Skyeye - Command Injection
Dromara Skyeye contains a command injection caused by improper sanitization of the format parameter in the unauthenticated /post/TtsController/textToSpeech endpoint, letting remote attackers execute OS commands as the Skyeye service account on Windows, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-107779 No auth
Dromara Skyeye - Authentication Bypass
Dromara Skyeye contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false), letting unauthenticated attackers execute commands or stop/delete jobs on the executor host via crafted POST requests.
- 7.1 /10 HighCVE-2026-107734 No auth
SumatraPDF - Command Injection
SumatraPDF <= 3.5.2 contains a command injection caused by unsafe substitution of attacker-controlled SyncTeX source filename in external editor command line, letting attackers inject command-line flags via crafted .synctex.gz files, exploit requires user to open PDF and invoke inverse search with configured external editor.
- 8.4 /10 HighCVE-2026-107732 No auth
SumatraPDF - Command Injection
SumatraPDF <= 3.6.1 contains a command injection caused by untrusted document paths and PDF link targets being interpreted as trusted tip markup in ParseTip(), letting attackers execute local programs in the user's context, exploit requires user interaction.
- 7.5 /10 HighCVE-2026-107728 No auth
Strawberry GraphQL - Broken Access Control
Strawberry GraphQL 0.217.0 < 0.326.1 contains a broken access control caused by improper handling of awaitable return values in synchronous PermissionExtension.resolve(), letting attackers bypass permission checks, exploit requires synchronous field resolvers with custom has_permission() returning awaitable.
- 9.3 /10 CriticalCVE-2026-107726 No auth
Hazelcast - Information Disclosure & Remote Code Execution
Hazelcast < 5.4.5, < 5.5.10, and < 5.6.1 contain an information disclosure and potential remote code execution caused by improper validation of data from malicious clients, letting attackers read arbitrary memory and crash or corrupt cluster members, exploit requires attacker to connect to the cluster.
- 8.7 /10 HighCVE-2026-107725 Auth required
Hazelcast - Remote Code Execution
Hazelcast < 5.4.5, < 5.5.10, and < 5.6.1 contain a remote code execution caused by missing authorization checks in the IMap Predicates API, letting malicious clients with limited privileges execute arbitrary code on cluster members, exploit requires client access with limited privileges.
- 7.4 /10 HighCVE-2026-107724
fast-jwt - Authentication Bypass
fast-jwt 6.2.4 contains a broken authentication caused by misclassification of raw serialized public JWK or JWKS JSON as HMAC secret in src/crypto.js, letting attackers create tokens with arbitrary claims, exploit requires knowledge of exact serialized public-key bytes.