Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 25 of 677
- 7.6 /10 HighCVE-2026-55382 Auth required
InvoiceShelf - Broken Access Control
InvoiceShelf < 2.4.0 contains a broken access control vulnerability caused by improper authorization checks in NotesController methods, letting authenticated staff users access and modify notes of other companies, exploit requires authenticated staff user privileges.
- 7.1 /10 HighCVE-2026-55381 Auth required
InvoiceShelf - Broken Access Control
InvoiceShelf < 2.4.0 contains a broken access control caused by improper authorization of route-bound Estimate in ConvertEstimateController, letting authenticated users with create-invoice ability copy and modify other companies' invoice data, exploit requires authenticated user with create-invoice ability.
- 7.3 /10 HighCVE-2026-54702 No auth
Markdown Preview Enhanced - Command Injection
Markdown Preview Enhanced < 0.8.30 contains a command injection caused by unvalidated attacker-controlled command and args in the webview message handler, letting attackers execute privileged extension commands, exploit requires prior webview JavaScript execution.
- 8.5 /10 HighCVE-2026-54566 No auth
Markdown Preview Enhanced - Command Injection
Markdown Preview Enhanced < 0.8.29 contains a command injection caused by unsafe evaluation of repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, letting attackers execute OS commands as the victim user, exploit requires opening a Markdown file in a malicious repository.
- 7.5 /10 HighCVE-2026-54554 No auth
FOG - Information Disclosure
FOG < 1.5.10.1870 contains an information disclosure vulnerability caused by the management adInfo() endpoint returning default domain-join credentials in the domainpass JSON field without authentication, letting remote unauthenticated attackers access sensitive credentials.
- 8.8 /10 HighCVE-2026-54525 No auth
Markdown Preview Enhanced - Command Injection
Markdown Preview Enhanced < 0.8.28 contains a command injection caused by unsafe handling of decoded Markdown-controlled link targets in Windows file-opening helper, letting attackers execute arbitrary commands with user privileges, exploit requires a user to click a crafted preview-link.
- 7.7 /10 HighCVE-2026-53999 Auth required
Radius - Broken Access Control
Radius < 0.58.0 contains a broken access control caused by deserialization of user-controlled radapp.io/status annotation without ownership verification, letting attackers with Deployment annotation modification permissions delete other tenants' container resources, exploit requires permission to modify Deployment annotations and knowledge of target Radius resource ID.
- 8.0 /10 HighCVE-2026-53615 No auth
util-linux - Data Tampering
util-linux < 2.41.4 contains a partition metadata integrity compromise caused by 32-bit addition overflow and missing bounds checks in parse_dos_extended(), letting local attackers cause false overlapping partition reports, exploit requires crafted DOS extended-partition disk image.
- 7.0 /10 HighCVE-2026-53614 Auth required
util-linux - Privilege Escalation
util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1 contain a privilege escalation caused by unsafe handling of LIBMOUNT_FORCE_MOUNT2 environment variable in the SUID mount utility, letting local low-privileged users gain root privileges by exploiting a race condition with bind mounts, exploit requires authorized /etc/fstab bind mount with specific options.
- 7.0 /10 HighCVE-2026-53613 PoC publicAuth required
util-linux - Privilege Escalation
util-linux 2.17 through 2.41.6, 2.42 through 2.42.3, and 2.42.4 with legacy mount path without /proc contains a privilege escalation caused by improper validation of /etc/fstab targets allowing local low-privileged users to redirect mounts to root-owned locations, letting attackers gain root privileges, exploit requires fstab user or users entry with attacker-writable ancestor.
- 7.0 /10 HighCVE-2026-53612 Auth required
util-linux - Privilege Escalation
util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1 contain a privilege escalation caused by a race condition in the SUID mount utility's hook_owner.c post-mount hook performing path-based chmod() and lchown() operations, letting local low-privileged users with specific /etc/fstab authorization gain root privileges, exploit requires user or users fstab entry with X-mount options.
- 8.5 /10 HighCVE-2026-50218 Auth required
Akamai GPA - Authentication Bypass
Akamai GPA (Guardicore Platform Agent) client < 7.4 contains a broken authentication caused by improper validation of JWT tokens used for seeding, letting attackers inject arbitrary parameters and fully compromise the client, exploit requires user interaction with a malicious link or knowledge of the IDP URL.
- 8.7 /10 HighCVE-2026-42093 Auth required
Redash - SQL Injection
Redash > 8.0.0 and < 26.9.0 contains a SQL injection caused by unsafe substitution of param_query_N_{key=value} parameters in Query Results query runner, letting authenticated users with view access inject SQL with referenced data source privileges, exploit requires authenticated user with view access to both data sources.
- 8.8 /10 HighCVE-2026-33798 No auth
Juniper Networks Junos OS - Buffer Overflow
Juniper Networks Junos OS and Junos OS Evolved on SRX Series contain a stack-based buffer overflow caused by improper handling in srxpfe, letting L2-adjacent attackers execute arbitrary code as root via high-availability fabric traffic, exploit requires L2 adjacency.
- 9.8 /10 CriticalCVE-2026-33796 No auth
Juniper Networks Junos OS - Remote Code Execution & Privilege Escalation
Juniper Networks Junos OS and Junos OS Evolved contain a stack-based buffer overflow caused by improper handling in the routing protocol daemon (rpd) during BMP route monitoring, letting configured external BGP neighbors execute arbitrary commands with root privileges, exploit requires configured external BGP neighbor.