Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 219 of 695
- 8.1 /10 HighCVE-2026-107723 Auth required
fast-jwt - Authentication Bypass
fast-jwt < 6.3.0 contains a broken authentication caused by accepting JSON array payloads in JWTs without proper claim validation, letting attackers bypass expiry, issuer, audience, subject, revocation, and replay protections, exploit requires attacker to produce or influence a validly signed token.
- 9.8 /10 CriticalCVE-2026-107722
fast-jwt - Authentication Bypass
fast-jwt 6.2.0 to 6.3.0 contains an authentication bypass caused by misclassification of RSA public-key text as HMAC secret due to improper PEM header detection, letting attackers sign arbitrary HS256 claims, exploit requires attacker knowledge of public key bytes.
- 7.4 /10 HighCVE-2026-107720 No auth
fast-jwt - Authentication Bypass
fast-jwt < 6.3.1 contains an authentication bypass caused by accepting unsigned JWTs when key is empty or null and algorithms allowlist is non-empty, letting attackers bypass signature verification and submit arbitrary claims.
- 7.3 /10 HighCVE-2026-107716
Banks DirectoryPromptRegistry - Path Traversal
Banks DirectoryPromptRegistry < 2.5.1 contains a symbolic link handling vulnerability caused by lack of symlink rejection in index.json and .jinja prompt files, letting attackers with influence over the prompt directory read or overwrite external files, exploit requires attacker control over the registry directory or its contents.
- 7.8 /10 HighCVE-2026-107709 No auth
Bower decompress-zip - Path Traversal
Bower decompress-zip <= 0.3.3 contains a path traversal vulnerability caused by improper validation of archive entry paths in lib/decompress-zip.js, letting attackers overwrite arbitrary files during ZIP extraction, exploit requires crafted ZIP archive.
- 7.8 /10 HighCVE-2026-107707 Auth required
Intego Antivirus for Windows - Remote Code Execution
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in the optimization module, letting local unprivileged attackers delete arbitrary folders and execute code as SYSTEM by abusing Windows Installer rollback, exploit requires local access.
- 9.8 /10 CriticalCVE-2026-107704 No auth
image_optimizer Ruby gem - Command Injection
image_optimizer Ruby gem 1.3.0 through 1.9.0 contains a command injection caused by improper sanitization of image path in ImageOptimizer#identify_format, letting attackers execute OS commands with Ruby process privileges, exploit requires crafted image path with shell metacharacters.
- 9.8 /10 CriticalCVE-2026-107703 No auth
@enmaso/node-convert - Command Injection
@enmaso/node-convert <= 1.0.0 contains a command injection caused by unsanitized filepath and convertTo arguments in convert.js, letting attackers execute OS commands with Node.js process privileges, exploit requires crafted input.
- 8.2 /10 HighCVE-2026-107701 No auth
dot-access - Prototype Pollution
dot-access contains a prototype pollution vulnerability caused by crafted dotted path input to set(), letting attackers modify Object.prototype to alter authorization flags, option defaults, or crash the process, exploit requires attacker control of input path.
- 9.8 /10 CriticalCVE-2026-107700 No auth
dot-access - Command Injection
dot-access 0.0.3 through 1.0.0 contains a command injection caused by concatenation of crafted paths into a new Function body in index.js, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-107699 No auth
ppt2png - Command Injection
ppt2png <= 0.0.6 contains a command injection caused by unsanitized input in file name arguments to child_process.exec() in ppt2png.js, letting attackers execute OS commands with Node.js process privileges.
- 9.1 /10 CriticalCVE-2026-107640 No auth
Integrics Enswitch - Authentication Bypass
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass caused by omission of the reset parameter in /api/json/user/password/update/, letting unauthenticated attackers change account passwords and take over administrator accounts, exploit requires valid username enumeration.
- 8.8 /10 HighCVE-2026-107639 Auth required
ILIAS - Remote Code Execution
ILIAS < 9.24, 10.x < 10.12, and 11.x < 11.5 contain a command injection caused by improper sanitization of ImageMagick convert options in uploaded image filenames in assImagemapQuestionGUI, letting question authors execute remote code by writing PHP files under the web root, exploit requires question author privileges.
- 7.8 /10 HighCVE-2026-107615 Auth required
GlavSoft TightVNC Server - Remote Code Execution & Privilege Escalation
GlavSoft TightVNC Server for Windows < 2.8.88 contains an uncontrolled search path element vulnerability caused by loading DLLs without secure search flags, letting local authenticated users execute arbitrary code with SYSTEM privileges.
- 7.8 /10 HighCVE-2026-107612 Auth required
GlavSoft TightVNC Server - Broken Access Control
GlavSoft TightVNC Server for Windows < 2.8.88 contains an incorrect permission assignment caused by a NULL DACL on a named shared memory segment with predictable name, letting local authenticated users read or overwrite IPC handles, exploit requires local authentication.