Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 22 of 891
- 7.5 /10 HighCVE-2026-63341 No auth
Aedes MQTT broker - Denial of Service
Aedes MQTT broker < 1.1.1 contains a denial of service caused by unbounded topic depth triggering an uncaught exception in qlobber, letting attackers disconnect all clients and crash the broker, exploit requires MQTT session establishment.
- 8.8 /10 HighCVE-2026-63339 Auth required
IXP Manager - Privilege Escalation
IXP Manager < 7.3.0 contains a privilege escalation caused by improper access control, letting authenticated non-administrative users elevate their privileges to administrator status, exploit requires user authentication.
- 8.3 /10 HighCVE-2026-63338 Auth required
IXP Manager - Broken Access Control
IXP Manager < 7.3.0 contains a broken access control caused by missing user_id verification in ApiKeyController, letting authenticated users view and edit other users' API keys, exploit requires authentication.
- 7.2 /10 HighCVE-2026-63224 Auth required
OpenRemote - SQL Injection
OpenRemote prior to 1.26.0 contains a SQL injection caused by improper escaping of asset and attribute names in the datapoint export API's CSV crosstab SQL query, letting authenticated users with asset creation and export permissions exfiltrate database data, exploit requires authenticated user with asset management and datapoint export permissions.
- 7.1 /10 HighCVE-2026-63201 Auth required
Netopeer2 - Denial of Service
Netopeer2 <= 2.8.7 contains a denial of service caused by improper format string handling in np2log(), letting low-privileged authenticated NETCONF users crash netopeer2-server remotely via crafted get RPC with invalid subtree filter.
- 7.1 /10 HighCVE-2026-63184 No auth
Refitter - Server Side Request Forgery & File Inclusion
Refitter prior to 2.1.1 contains a server-side request forgery and file inclusion vulnerability caused by unsafe $ref resolution in NJsonSchema when processing attacker-controlled OpenAPI descriptions, letting remote attackers cause SSRF and local file disclosure, exploit requires attacker-controlled OpenAPI input.
- 8.1 /10 HighCVE-2026-63182
LightSAML - Authentication Bypass
LightSAML < 4.7.1 and < 5.0.1 contains an authentication bypass caused by signature validation mismatch in SAML assertion processing, letting attackers bypass authentication or escalate privileges by exploiting assertion signature confusion, exploit requires attacker to capture a genuine signed assertion.
- 8.7 /10 HighCVE-2026-62990 Auth required
Shopper - Stored XSS & Privilege Escalation
Shopper 2.0.0 to < 2.10.1 and 3.0.0-beta.1/beta.2 contain a stored XSS caused by executable media upload with insufficient MIME restrictions, letting authenticated back-office staff with content-upload permission execute scripts in admin sessions, exploit requires the administrator to open the uploaded file.
- 8.1 /10 HighCVE-2026-62989 Auth required
Shopper - Broken Access Control
Shopper < 2.10.0 contains a broken access control caused by missing server-side authorization in Variants Livewire component, letting authenticated staff users with edit_products permission delete product variants without delete_product_variants permission, exploit requires authenticated staff user with edit_products permission.
- 8.4 /10 HighCVE-2026-62979 Auth required
jack - Information Disclosure
jack before 0.1.0 contains an information disclosure caused by serialization of internal Radarr/Sonarr API keys and Cloudflare Access secrets in error responses, letting clients with shared peer API keys access sensitive credentials without user interaction.
- 8.7 /10 HighCVE-2026-62968 No auth
Dream Displays - Command Injection
Dream Displays 1.5.0 to 1.8.2 contains a command injection caused by user-controlled input influencing arguments passed to yt-dlp, letting attackers alter command behavior, exploit requires specific input conditions.
- 8.1 /10 HighCVE-2026-62967 Auth required
ZTNET - Authentication Bypass
ZTNET < 0.8.0 contains an authentication bypass caused by insufficient user ID verification in invalidateUser API, letting authenticated low-privilege users deactivate other accounts including administrators, exploit requires authenticated user with victim's user ID.
- 7.5 /10 HighCVE-2026-62966 No auth
ESPAsyncWebServer - Denial of Service
ESPAsyncWebServer < 3.11.2 contains a denial of service caused by improper handling of multipart parser buffer freeing in src/WebRequest.cpp, letting remote attackers cause device reboot via crafted upload, exploit requires a route with a non-trivial body/upload handler.
- 7.0 /10 HighCVE-2026-62965 Auth required
SABnzbd - Path Traversal
SABnzbd prior to 5.1.0Beta3 contains a path traversal caused by improper path confinement of user-controlled 'value' parameter in orphan-job management API, letting attackers with valid API keys delete writable files/directories, exploit requires valid API key.
- 7.9 /10 HighCVE-2026-62958 PoC publicNo auth
libriscv - Out-of-Bounds Read
libriscv < 1.18 contains an out-of-bounds read caused by improper validation of section-header offsets in binary loading, letting attackers crash the host or potentially disclose host memory, exploit requires crafted ELF binary.