Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 231 of 695
- 7.4 /10 HighCVE-2026-16516
wolfSSH - Man-in-the-Middle
wolfSSH contains a man-in-the-middle vulnerability caused by improper validation of ECDSA curve identifiers in KEXDH_REPLY host key blobs, letting active network attackers bypass signature verification, exploit requires active MitM and lax public key checks.
- 8.8 /10 HighCVE-2026-15894 No auth
Zephyr Bluetooth Mesh - Buffer Overflow
Zephyr Bluetooth Mesh On-Demand Private Proxy (CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled) contains a buffer overflow caused by copying an oversized Solicitation PDU into a fixed 17-byte stack buffer without length bounds, letting remote attackers send crafted unauthenticated advertisements to cause stack overwrite, exploit requires attacker to be in radio range.
- 9.3 /10 CriticalCVE-2026-14911 No auth
ASUS Router - Stored XSS
ASUS router modules contain a stored XSS caused by improper neutralization of input during web page generation, letting remote attackers read DOM information, modify settings, and cause denial of service when an authenticated user visits a crafted URL.
- 7.7 /10 HighCVE-2026-107352 Auth required
Amazon Athena - Broken Access Control
Amazon Athena engine version 3 contains a broken access control vulnerability caused by missing authorization checks in request handling, letting authenticated users read limited query metadata from other AWS accounts, exploit requires user authentication.
- 9.4 /10 CriticalCVE-2026-107282 No auth
AsyncHttpClient - Information Disclosure
AsyncHttpClient < 3.0.13 and < 2.16.1 contains a cross-host request replay vulnerability caused by improper update of target request and proxy context, letting attackers cause sensitive data leakage to unintended hosts, exploit requires crafted request triggering replay.
- 7.6 /10 HighCVE-2026-107281 Auth required
AsyncHttpClient - Broken Access Control
AsyncHttpClient < 3.0.13 and < 2.16.1 contains a broken access control caused by HTTP/1.1 connection-pool key excluding authenticated principal for NTLM and Negotiate authentication, letting attackers reuse authenticated sockets as another identity, exploit requires use of connection-oriented NTLM or Negotiate authentication.
- 8.8 /10 HighCVE-2026-107279 No auth
AsyncHttpClient - Authentication Bypass
AsyncHttpClient 3.0.12 contains an authentication bypass caused by improper handling of Digest qop=auth-int in mutual-authentication verification, letting attackers impersonate authenticated servers, exploit requires crafted server response.
- 7.1 /10 HighCVE-2026-107270 Auth required
Gophish - Broken Access Control
Gophish <= 0.12.1 contains an insecure direct object reference vulnerability caused by insufficient authorization checks in API endpoints, letting authenticated users take over other users' groups, templates, landing pages, and sending profiles by supplying another user's sequential ID.
- 7.5 /10 HighCVE-2026-107232
AsyncHttpClient - Authentication Bypass
AsyncHttpClient < 3.0.12 (3.x) and < 2.16.1 (2.x) contains an information disclosure caused by improper handling of proxy CONNECT rejection, letting attackers recover or relay credentials over plaintext proxy connections, exploit requires use of HTTP proxy with CONNECT rejection.
- 8.7 /10 HighCVE-2026-107231
AsyncHttpClient - Authentication Bypass
AsyncHttpClient < 3.0.13 and < 2.16.1 contains an authentication bypass caused by treating Digest challenges with no usable nonce as Basic challenges, letting attackers cause clients to resend credentials in Basic auth, exploit requires attacker to control origin or proxy.
- 7.4 /10 HighCVE-2026-107230 No auth
AsyncHttpClient - Broken Access Control
AsyncHttpClient 2.0.0 to 3.0.14 contains a broken access control vulnerability caused by connection-pool partitioning omitting identity-defining fields for various authentication methods, letting attackers access data or authority of other identities, exploit requires use of authenticated proxy or Kerberos/SPNEGO/NTLM logins.
- 7.5 /10 HighCVE-2026-107227 No auth
AsyncHttpClient - Denial of Service
AsyncHttpClient 2.2.0 to 3.0.14 contains a denial of service caused by unbounded WebSocket permessage-deflate decompression, letting malicious WebSocket peers exhaust JVM heap, exploit requires compression enabled.
- 7.5 /10 HighCVE-2026-107223 PoC publicNo auth
Excelize - Denial of Service
Excelize 2.1.0 to 2.11.0 contains a denial of service caused by improper validation of column range limits in flatCols, letting attackers consume excessive CPU and memory via crafted worksheet columns, exploit requires invoking a column mutator.
- 7.5 /10 HighCVE-2026-107219 PoC publicNo auth
Excelize - Denial of Service
Excelize 2.3.1 to 2.11.0 contains a denial of service caused by unbounded spinCount in agile decryption key derivation, letting attackers consume CPU resources indefinitely, exploit requires crafted OLE encrypted workbook.
- 7.5 /10 HighCVE-2026-107217 PoC publicNo auth
Excelize - Denial of Service
Excelize 2.0.0 to 2.11.0 and 1.1.0 to 1.4.1 contains a denial of service caused by integer overflow in ColumnNameToNumber leading to negative slice index panic during worksheet normalization, letting attackers terminate the process, exploit requires crafted worksheet with long column name.