Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 232 of 695

  • 7.5 /10 High
    CVE-2026-107216 PoC publicNo auth

    Excelize - Denial of Service

    Excelize 2.8.1 to 2.11.0 contains a stack overflow caused by recursive calls to CalcCellValue in ANCHORARRAY bypassing cycle controls, letting attackers cause fatal Go stack overflow, exploit requires crafted mutually referencing dynamic-array formulas.

  • 7.5 /10 High
    CVE-2026-107215 PoC publicNo auth

    Excelize - Denial of Service

    Excelize 2.3.1 to 2.11.0 contains a denial of service caused by improper validation of CFB directory-entry sizes in extractPart, letting attackers cause panic or memory exhaustion via crafted OLE files, exploit requires crafted file input.

  • 7.5 /10 High
    CVE-2026-107214 PoC publicNo auth

    Excelize - Denial of Service

    Excelize 2.3.1 to 2.11.0 contains a denial of service caused by insufficient validation in decryption dispatch leading to Go runtime panics when processing malformed OLE compound files, letting attackers terminate the process, exploit requires crafted malicious files.

  • 7.5 /10 High
    CVE-2026-107212 PoC publicNo auth

    Excelize - Denial of Service

    Excelize 2.1.0 to 2.11.0 contains a denial of service caused by improper row number limit checks in Rows.Columns and Rows.Next, letting attackers consume CPU resources by crafted worksheets, exploit requires processing crafted Excel files.

  • 7.2 /10 High
    CVE-2026-107207 No auth

    LMCache - Server Side Request Forgery

    LMCache <= 0.5.5 contains a server-side request forgery caused by improper validation in the frontend monitoring service, letting unauthenticated attackers bypass proxy allowlist to access internal hosts and tamper nodes, exploit requires ability to register arbitrary hosts via POST /api/proxies.

  • 9.4 /10 Critical
    CVE-2026-107206 No auth

    LMCache - Authentication Bypass

    LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server, letting remote unauthenticated attackers access management endpoints and manipulate cache and configuration.

  • 8.6 /10 High
    CVE-2026-107205 No auth

    LMCache - Authentication Bypass

    LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator's HTTP fleet control API, letting remote unauthenticated attackers access and manipulate instances, quotas, events, and directory keys, exploit requires default API exposure on all interfaces.

  • 9.8 /10 Critical
    CVE-2026-107204 No auth

    LMCache - Remote Code Execution

    LMCache <= 0.5.5 contains a remote code execution caused by unauthenticated script posting to /run_script endpoint, letting remote attackers execute arbitrary Python code, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-107202 No auth

    h-ui - Command Injection

    h-ui v0.0.25 and below contains a command injection caused by improper validation of the listen configuration field in the administrative API, letting authenticated administrators execute arbitrary OS commands as root, exploit requires administrator authentication.

  • 9.2 /10 Critical
    CVE-2026-107194 No auth

    Sungrow iSolarCloud - Authentication Bypass

    Sungrow iSolarCloud < 2026 contains an authentication bypass caused by improper handling of "login_type":"5" in login requests, letting attackers bypass authentication and take over accounts, exploit requires user email address.

  • 8.1 /10 High
    CVE-2026-107183 No auth

    llama.cpp - Use After Free

    llama.cpp before b11393 contains a use-after-free and double free vulnerability caused by a dangling current_tool pointer in common_chat_peg_mapper::map, letting unauthenticated remote attackers corrupt heap memory via crafted POST /completion requests.

  • 8.1 /10 High
    CVE-2026-107181 PoC publicNo auth

    Telegram Desktop - Authentication Bypass

    Telegram Desktop < 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox, letting remote attackers inject OPEN: records via crafted tg:// links to upload local files and enable account takeover, exploit requires crafted tg:// links with unescaped semicolons.

  • 7.1 /10 High
    CVE-2026-107180 Auth required

    MISP - Authentication Bypass

    MISP < 2.5.48 contains a broken authentication caused by improper enforcement of mandatory TOTP two-factor authentication on non-browser requests, letting authenticated users bypass TOTP enrollment and retain full access, exploit requires user authentication.

  • 7.5 /10 High
    CVE-2026-107161

    Cyrus SASL - Buffer Overflow

    Cyrus SASL contains a heap-based buffer overflow caused by incorrect buffer size calculation in the DIGEST-MD5 plugin's add_to_challenge() function, letting malicious or on-path servers crash the client by supplying crafted challenge fields, exploit requires attacker-controlled server.

  • 9.3 /10 Critical
    CVE-2026-107104 No auth

    ERP system - Insecure Deserialization

    ERP system contains an insecure deserialization vulnerability caused by unsafe deserialization of user-controlled data, letting unauthenticated remote attackers execute arbitrary code or manipulate data, exploit requires crafted input.