Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 24 of 891
- 8.7 /10 HighCVE-2026-62160 No auth
Daptin - Denial of Service
Daptin < 0.12.26 contains a denial of service caused by improper validation of Accept-Language headers in LanguageMiddleware, letting unauthenticated attackers cause high CPU usage via crafted headers, exploit requires sending large malformed headers.
- 8.2 /10 HighCVE-2026-61854 No auth
VoiceSentinel - Race Condition
VoiceSentinel 2.2.1 to 3.3.1 contains a race condition in the report buffer feature caused by unsynchronized concurrent writes and cleanups in transcript handling, letting attackers cause data corruption and unbounded disk growth, exploit requires report buffer enabled and concurrent processing.
- 9.3 /10 CriticalCVE-2026-61850 Auth required
Kargo - Broken Access Control
Kargo 0.6.0 to 1.8.14, 1.9.9, and 1.10.8 contain an authorization bypass caused by insufficient permission checks in project-scoped RBAC API, letting authenticated delegated users escalate privileges within a Project, exploit requires custom admin-created roles.
- 8.9 /10 HighCVE-2026-61845 No auth
Crass - Denial of Service
Crass < 1.0.7 contains a denial of service caused by unbounded exponentiation in CSS scientific notation number parsing, letting attackers cause high CPU and memory usage, exploit requires attacker-controlled CSS input.
- 10.0 /10 CriticalCVE-2026-61826 No auth
Bazarr - Broken Access Control
Bazarr prior to 1.5.7-beta.14 contains a broken access control vulnerability caused by missing authentication on api_ns_plex namespace handlers, letting anonymous attackers modify Plex integration settings, persist API keys, and cause denial of service, exploit requires no authentication or preconditions.
- 8.1 /10 HighCVE-2026-61804 Auth required
myTinyWMS - Stored XSS
myTinyWMS < 1.6.4 contains a stored XSS caused by inadequate backend sanitization of 'name' parameter in product and category management, letting authenticated attackers execute scripts in other users' browsers, exploit requires authentication.
- 7.5 /10 HighCVE-2026-61739 No auth
SOCFortress CoPilot - Broken Access Control
SOCFortress CoPilot < 0.1.77 contains a broken access control vulnerability caused by missing role and tenant authorization in Velociraptor Sigma exclusion-management endpoints, letting authenticated customer users suppress detections and manage exclusions across tenants, exploit requires authenticated customer user.
- 10.0 /10 CriticalCVE-2026-61738 No auth
SOCFortress CoPilot - Path Traversal
SOCFortress CoPilot < 0.1.77 contains a path traversal caused by unsanitized filename in POST /api/scoutsuite/generate-gcp-report, letting admin and analyst users write files outside intended directories, exploit requires admin or analyst privileges.
- 9.8 /10 CriticalCVE-2026-61737 No auth
ng-antd-admin - Authentication Bypass
ng-antd-admin < 22.0 contains a broken authentication caused by a hardcoded default JWT secret, letting attackers bypass authentication and impersonate any user, exploit requires deployment with default secret.
- 9.3 /10 CriticalCVE-2026-61730 No auth
SOCFortress CoPilot - Information Disclosure
SOCFortress CoPilot contains an information disclosure vulnerability caused by unauthenticated access to the /scoutsuite-report StaticFiles mount exposing sensitive cloud IAM principals and private Google service-account keys, letting anonymous attackers access sensitive cloud credentials and reports, exploit requires network access to the host during scans.
- 9.4 /10 CriticalCVE-2026-61729 No auth
SOCFortress CoPilot - Authentication Bypass
SOCFortress CoPilot < 0.1.76 contains an authentication bypass caused by publicly hardcoded fallback API header values in webhook verification, letting anonymous attackers bypass JWT authentication and execute active-response commands, exploit requires unset or default header secrets.
- 9.9 /10 CriticalCVE-2026-61728 Auth required
SOCFortress CoPilot - Stored XSS & Privilege Escalation
SOCFortress CoPilot < 0.1.70 and < 0.1.76 contains a stored XSS caused by unsanitized HTML in alert comments and other SOC fields, letting authenticated portal users execute persistent scripts, exploit requires user authentication.
- 8.5 /10 HighCVE-2026-61708 Auth required
SOCFortress CoPilot - Unrestricted File Upload
SOCFortress CoPilot < 0.1.76 contains an unrestricted file upload vulnerability caused by lack of allowlist, tenant prefix, ownership check, or content restriction in POST /api/agent_data_store/upload, letting low-privilege customer_user attackers overwrite cross-tenant files, exploit requires attacker to have customer_user privileges.
- 7.3 /10 HighCVE-2026-61627 No auth
libass - Denial of Service
libass < 0.17.5 contains a buffer overread and overwrite caused by improper handling of glyph arrays in wrap_lines_measure during rendering of malicious ASS content, letting attackers cause denial of service, exploit requires crafted subtitle content.
- 7.3 /10 HighCVE-2026-61626 No auth
libass - Denial of Service
libass 0.17.4 contains a denial of service caused by lack of guard for negative Matroska ReadOrder values in event pruning, letting attackers cause crashes via malicious Matroska streams, exploit requires enabled read-order checking and event pruning.