Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 25 of 891

  • 9.8 /10 Critical
    CVE-2026-61620 No auth

    HoneySQL - SQL Injection

    HoneySQL 2.0.0 to 2.7.1392 contains a SQL injection caused by improper sanitization of user input passed to keyword or symbol functions in the DSL, letting attackers execute arbitrary SQL commands, exploit requires unvalidated input.

  • 8.2 /10 High
    CVE-2026-61586 No auth

    Copernik XML Factory - XML External Entity Injection

    Copernik XML Factory < 0.1.2 contains an XML External Entity Injection caused by lack of blocking XInclude resource resolution in stock JDK provider, letting attackers disclose local files or perform SSRF via crafted XML, exploit requires enabling XInclude and parsing untrusted XML.

  • 7.5 /10 High
    CVE-2026-59978

    AdminNeo - Denial of Service

    AdminNeo 4.6.2 to < 5.5.0 contains a denial of service caused by improper type validation in the unauthenticated ?script=version endpoint, letting remote attackers cause HTTP 500 errors by poisoning shared cache, exploit requires writable shared cache.

  • 8.8 /10 High
    CVE-2026-59387 Auth required

    Cloud Controller - Authentication Bypass

    Cloud Controller contains an authentication bypass caused by missing deny rule for /internal/v3/ endpoints in Nginx routing, letting attackers with a valid build or droplet GUID submit forged staging callbacks and escalate privileges, exploit requires valid build or droplet GUID.

  • 8.2 /10 High
    CVE-2026-58412 No auth

    Filecoin Pin - Broken Access Control

    Filecoin Pin < 1.1.0 contains a broken access control vulnerability caused by improper fork pull-request detection in upload GitHub Action, letting external contributors upload artifacts using the repository owner's wallet, exploit requires untrusted fork pull-request workflows.

  • 9.1 /10 Critical
    CVE-2026-55598 Auth required

    PinePods - Server Side Request Forgery

    PinePods < 0.9.0 contains a server-side request forgery caused by unvalidated enclosure URLs in podcast feeds, letting authenticated low-privilege users make internal network requests and access sensitive data, exploit requires server downloads enabled.

  • 7.1 /10 High
    CVE-2026-54855 No auth

    Profile Builder - Stored XSS

    Profile Builder <= 4.0.5 contains an unauthenticated stored cross site scripting caused by improper input sanitization, letting remote attackers execute scripts without authentication.

  • 7.1 /10 High
    CVE-2026-48201 No auth

    Fast Velocity Minify - Reflected XSS

    Fast Velocity Minify <= 3.5.7 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-46560 No auth

    Open Access Management OpenAM - Authentication Bypass

    Open Access Management (OpenAM) < 16.1.1 contains an authentication bypass caused by improper validation of RADIUS responses in the authentication module, letting unauthenticated network attackers impersonate users, exploit requires network access to send forged UDP packets.

  • 7.5 /10 High
    CVE-2026-45145 Auth required

    Chamilo LMS - Insecure Deserialization

    Chamilo LMS < 2.0.1 contains an insecure deserialization caused by unsafe unserialize() usage on user_career.extra_data, letting attackers with write access to this data execute arbitrary OS commands, exploit requires ability to write crafted serialized objects.

  • 8.9 /10 High
    CVE-2026-45144 Auth required

    Chamilo LMS - Stored XSS

    Chamilo LMS 2.0.0 to 2.0.1 contains a stored XSS caused by unsanitized user-editable profile fields rendered with autoescape disabled, letting ROLE_STUDENT attackers execute scripts in visitors' browsers, exploit requires self-registration enabled.

  • 8.6 /10 High
    CVE-2026-40573 No auth

    NovumOS - Privilege Escalation

    NovumOS prior to 0.25-beta.1 contains a privilege escalation caused by the Nova interpreter running in Ring 0 without isolation, letting local users execute code with kernel privileges via malicious .nv scripts.

  • 7.1 /10 High
    CVE-2026-39786 No auth

    BA Book Everything - Reflected XSS

    BA Book Everything <= 1.8.33 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-39738 No auth

    FunnelKit Automations - Insecure Deserialization

    FunnelKit Automations <= 3.8.6.1 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-39734 No auth

    WP EasyPay - Path Traversal

    WP EasyPay <= 4.5.4 contains a path traversal caused by improper input validation, letting unauthenticated attackers access arbitrary files, exploit requires no authentication.