Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 23 of 891
- 7.5 /10 HighCVE-2026-62864 No auth
Ring - Regular Expression Denial of Service
Ring < 1.15.5 contains a regular expression denial of service caused by backtracking regex in wrap-nested-params middleware, letting attackers cause denial of service via crafted parameter names, exploit requires crafted parameter names.
- 9.6 /10 CriticalCVE-2026-62863 No auth
MoLing - Broken Access Control
MoLing < 0.5.0 contains a broken access control vulnerability caused by unauthenticated SSE mode endpoints and permissive CORS, letting attackers steal sessionId via cross-origin EventSource and send unauthorized MCP tool calls, exploit requires victim to visit malicious web page.
- 9.9 /10 CriticalCVE-2026-62853 Auth required
ThingLinks - Remote Code Execution
ThingLinks < 1.4.0 contains a remote code execution caused by unsandboxed Groovy script compilation in /groovyScriptTest/registerScript endpoint, letting authenticated attackers execute arbitrary server-side code.
- 9.1 /10 CriticalCVE-2026-62849 No auth
ThingLinks - SQL Injection
ThingLinks prior to 1.4.0 contains an unauthenticated SQL injection caused by unsafe SQL construction from request-controlled JSON fields in TDengine TDS APIs, letting remote attackers tamper with time-series data, exploit requires no authentication.
- 7.3 /10 HighCVE-2026-62848 Auth required
Metalama Visual Studio - Insecure Deserialization
Metalama for Visual Studio 2023.0.101-rc to 2026.1.19 contains an insecure deserialization vulnerability caused by unrestricted CLR type instantiation in named-pipe messages, letting local same-user attackers execute arbitrary code, exploit requires local pipe write access.
- 8.2 /10 HighCVE-2026-62847 Auth required
Metalama - Privilege Escalation
Metalama.Framework and Metalama.Tool < 2025.1.18, 2026.0.25, 2026.1.19 contain a privilege escalation caused by loading and executing compile-time assemblies from predictable, world-writable temp directories on Linux/macOS, letting local unprivileged users escalate privileges by planting malicious DLLs, exploit requires shared machine or CI environment with multiple users.
- 8.7 /10 HighCVE-2026-62334 No auth
OpenVM zkVM - Authentication Bypass
OpenVM zkVM framework before 1.7.0 (1.x), 2.0 and 2.1 prereleases contains a broken authentication caused by improper verification in OpenVmHalo2Verifier.verify allowing arbitrary app commitments acceptance, letting attackers bypass proof validation, exploit requires crafted proofData with matching external selector.
- 8.7 /10 HighCVE-2026-62333
OpenVM - Authentication Bypass
OpenVM before 1.7.0 (1.x), 2.0.0-rc.3, and 2.1.0-preview contains a broken authentication caused by improper Merkle expansion row validation in MemoryMerkleAir, letting malicious provers alter committed memory roots without memory operations, exploit requires crafted Merkle subtree manipulation.
- 8.2 /10 HighCVE-2026-62331 No auth
Praktor - Path Traversal
Praktor < 0.9.1 contains a path traversal vulnerability caused by unsanitized document filename concatenation in Telegram upload sites, letting remote Telegram users write arbitrary files in the agent workspace, exploit requires messaging the bot.
- 8.7 /10 HighCVE-2026-62302 No auth
MyTube - Authentication Bypass
MyTube prior to version 1.10.3 contains an authentication bypass caused by middleware registration order in server.ts, letting unauthenticated clients access protected media routes, exploit requires loginEnabled=true.
- 7.1 /10 HighCVE-2026-62301 Auth required
MyTube - Broken Access Control
MyTube prior to version 1.10.3 contains an information disclosure caused by missing role and visibility checks in backend video access, letting visitors retrieve hidden video metadata and media files without authentication, exploit requires loginEnabled=true with visitor password configured.
- 7.5 /10 HighCVE-2026-62297 No auth
ag-psd - Denial of Service
ag-psd before 31.0.0 contains a denial of service caused by unvalidated attacker-declared PSD geometry leading to excessive memory allocation in psdReader.js, letting attackers exhaust memory remotely, exploit requires crafted PSD input.
- 8.6 /10 HighCVE-2026-62284 Auth required
OSAC operator - Command Injection & Server-Side Request Forgery
OSAC operator 8220502 contains a command injection caused by unsanitized exec credential plugin in kubeconfig Secrets parsed by console-proxy RemoteConfigResolver, letting attackers spawn arbitrary processes and perform SSRF, exploit requires Secret read access via RoleBinding.
- 7.5 /10 HighCVE-2026-62264 No auth
PDF Reader MCP - Authentication Bypass
PDF Reader MCP 2.2.0 to < 3.0.1 contains an authentication bypass caused by missing validation of X-API-Key header in HTTP server, letting unauthenticated clients access PDF tools and read files, exploit requires HTTP transport enabled.
- 8.2 /10 HighCVE-2026-62162 No auth
Hydra - Broken Access Control
Hydra prior to 2.1.0 contains a broken access control vulnerability caused by missing constraints on spending the Head state-token UTxO in deposit validator, letting third parties consume pending deposit UTxOs and redirect assets before the deposit deadline, exploit requires ability to build Cardano transactions.