Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 26 of 891

  • 9.3 /10 Critical
    CVE-2026-39732 No auth

    Transliterator - SQL Injection

    Transliterator <= 2.5.13 contains an SQL injection caused by unsanitized input in database queries, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-28160 No auth

    VikRentCar - Stored XSS

    VikRentCar <= 1.4.10 contains a stored XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 8.7 /10 High
    CVE-2026-22110 No auth

    Web Server - Broken Authentication

    The web server contains a broken authentication vulnerability caused by lack of authentication checks on POST or PUT requests, letting unauthenticated attackers reboot the charger and change settings by brute-forcing configid.

  • 8.4 /10 High
    CVE-2026-22109 Auth required

    WebUI Template Database - Authentication Bypass

    The WebUI template database contains a broken authentication vulnerability caused by retaining factory default passwords in cleartext for all five account types, letting attackers gain unauthorized access, exploit requires unchanged default credentials.

  • 8.7 /10 High
    CVE-2026-22105 No auth

    Delta UFC500 - Authentication Bypass

    Delta UFC500 charging stations contain a broken authentication vulnerability caused by default Service account credentials derived from device serial number characters, letting unauthenticated adjacent network attackers access and modify sensitive settings.

  • 8.8 /10 High
    CVE-2026-16760 No auth

    Trail of Bits fickling - Insecure Deserialization

    Trail of Bits fickling <= 0.1.12 contains a remote code execution caused by trusting callable safety based on module origin in _process_import(), letting attackers execute arbitrary code via pickle payloads, exploit requires deserialization of crafted pickle data.

  • 8.2 /10 High
    CVE-2026-14467 Auth required

    Forocoches Comments Editor - Information Disclosure

    Forocoches comments editor contains an information disclosure vulnerability caused by insertion of images with malicious external URLs in comments, letting attackers obtain unauthorized user information when victims view the thread, exploit requires victim to view the discussion.

  • 8.8 /10 High
    CVE-2026-119979 No auth

    LM Studio - Path Traversal & Remote Code Execution

    LM Studio < 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest, letting attackers write files outside the models directory and execute Python payloads on launch, exploit requires user to download crafted model repository.

  • 8.5 /10 High
    CVE-2026-119978 Auth required

    Flowise - Command Injection

    Flowise <= 3.1.4 contains a sandbox escape caused by abusing allowlisted langchain and mammoth modules with ALLOW_BUILTIN_DEP=true in /api/v1/node-custom-function, letting authenticated users execute OS commands as the Flowise process user.

  • 7.8 /10 High
    CVE-2026-119777 No auth

    GStreamer gst-plugins-bad - Buffer Overflow

    GStreamer gst-plugins-bad H.266/VVC parser contains a stack-based buffer overflow caused by integer overflow when parsing profile, tier, and level fields, letting attackers cause crashes or execute code, exploit requires crafted malformed media file.

  • 7.5 /10 High
    CVE-2026-119762 No auth

    Axigen Mail Server - Denial of Service

    Axigen Mail Server < 10.5.69, 10.6.x < 10.6.40, and 10.7.x < 10.7.2 contain an unauthenticated denial of service caused by unbounded nesting depth in SOAP/XML and JSON request parsing before authentication, letting attackers crash multiple services remotely.

  • 7.5 /10 High
    CVE-2026-119760 No auth

    sniproxy - Denial of Service

    sniproxy <= 0.7.0 contains a null pointer dereference vulnerability in resolv_cancel(), letting remote unauthenticated attackers crash the daemon by sending overlong TLS SNI names or HTTP Host headers matching wildcard backends.

  • 7.8 /10 High
    CVE-2026-119722 No auth

    Blender - Out of Bounds Read/Write

    Blender < 4.5.15 and 5.x < 5.2.3 contain a heap out-of-bounds access vulnerability caused by missing size validation in read_struct() when processing crafted .blend files, letting attackers cause crashes or execute code remotely, exploit requires crafted .blend file.

  • 7.8 /10 High
    CVE-2026-119719 No auth

    Blender - Buffer Overflow

    Blender < 4.5.15 and 5.x < 5.2.3 contain a heap buffer overflow caused by 32-bit integer overflow in thumb_data_vertical_flip() in the blend file thumbnail extractor, letting attackers execute code or cause crashes by crafting malicious .blend files, exploit requires previewing the file.

  • 7.8 /10 High
    CVE-2026-119718 No auth

    Blender - Buffer Overflow

    Blender < 4.5.15 and 5.x < 5.2.3 contain a heap buffer overflow caused by integer overflow in ptcache_data_alloc() when reading point cache files, letting attackers execute code or crash the application, exploit requires crafted point cache file.