Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 27 of 891

  • 8.1 /10 High
    CVE-2026-119717 No auth

    pybars4 - Code Injection

    pybars4 <= 0.9.13 contains a code injection vulnerability caused by unescaped bracketed path segments in Handlebars templates in pybars/_compiler.py, letting attackers execute arbitrary Python code, exploit requires crafted template input.

  • 8.1 /10 High
    CVE-2026-119716 No auth

    pybars3 - Code Injection

    pybars3 <= 0.9.7 contains a code injection vulnerability caused by unescaped bracketed path segments in pybars/_compiler.py, letting template authors execute arbitrary Python code, exploit requires crafted Handlebars templates.

  • 8.8 /10 High
    CVE-2026-119713 Auth required

    Paperclip - Remote Code Execution

    Paperclip < 2026.416.0 contains a remote code execution caused by agent API key holders setting cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id, letting attackers execute arbitrary OS commands on the server, exploit requires agent API key.

  • 7.1 /10 High
    CVE-2026-119710 Auth required

    PipesHub - Event Type Injection

    PipesHub < 0.10.0 contains an event type injection caused by injection into the :connector path segment, letting authenticated users with crawl:write scope delete connectors and purge record embeddings, exploit requires authentication with crawl:write scope.

  • 7.1 /10 High
    CVE-2026-119707 Auth required

    SonicJS - Broken Access Control

    SonicJS <= 3.0.0 contains a broken access control caused by insufficient authorization checks on /api/:collection and /api/content write routes, letting authenticated authors or editors bypass ACLs to modify others' documents, exploit requires authentication with author or editor role.

  • 9.8 /10 Critical
    CVE-2026-119706 No auth

    InternLM LMDeploy - Remote Code Execution

    InternLM LMDeploy 0.9.0 through 0.18.0 contains a remote code execution caused by unsafe deserialization of pickled data in /update_weights endpoint, letting unauthenticated remote attackers execute OS commands as api_server process.

  • 7.9 /10 High
    CVE-2026-119682 No auth

    ManageEngine SharePoint Manager Plus - Broken Access Control

    ManageEngine SharePoint Manager Plus < 4507 contains an improper access control vulnerability in MFA functionality, letting low-privileged authenticated users read/modify MFA settings and delete enrolled accounts, exploit requires low-privileged authentication.

  • 8.5 /10 High
    CVE-2026-119680 Auth required

    SharePoint Manager Plus - Stored XSS

    SharePoint Manager Plus contains a stored XSS caused by improper sanitization and HTML encoding of user-controlled data in chart attributes, letting attackers inject malicious scripts executed in other users' browsers, exploit requires user interaction.

  • 8.8 /10 High
    CVE-2026-119662 No auth

    Songloft - Hardcoded Credentials

    Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability caused by fixed admin/admin credentials in /api/v1/auth/login, letting adjacent network attackers authenticate as administrator and modify settings, exploit requires network adjacency.

  • 9.8 /10 Critical
    CVE-2026-119660 No auth

    MuseBot - Authentication Bypass

    MuseBot < 2.0.0 contains an authentication bypass caused by use of a hard-coded default session_key, letting unauthenticated attackers forge admin sessions and gain full administrative access, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-119656 No auth

    CoreShop by CoreUnion - SQL Injection

    CoreShop by CoreUnion through 1.5.5 contains an sql injection caused by improper sanitization of the order parameter in api/Agent/GetGoodsPageList endpoint, letting anonymous attackers extract member accounts and orders via blind techniques.

  • 7.5 /10 High
    CVE-2026-119655 No auth

    CoreShop - SQL Injection

    CoreShop <= 1.5.5 contains an unauthenticated SQL injection caused by unvalidated 'order' parameter in api/Good/GetGoodsPageList endpoint, letting attackers extract member accounts and orders via blind SQL techniques, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-119654 Auth required

    DataCap - Broken Access Control

    DataCap through 2025.1.1 contains a broken access control vulnerability caused by missing authorization checks in administrative role and menu management APIs, letting authenticated users escalate privileges by assigning themselves administrator roles.

  • 7.1 /10 High
    CVE-2026-119649 Auth required

    Orchard CMS - Broken Access Control

    Orchard CMS 1.10.3 through 1.11 contains a broken access control vulnerability caused by improper authorization in MediaLibraryService.CheckMediaFolderPermission(), letting authenticated Authors and Contributors access and manipulate other users' media, exploit requires authenticated author or contributor role.

  • 7.3 /10 High
    CVE-2026-119620 No auth

    cak-filemanagement-system - Unrestricted File Upload

    cak-filemanagement-system <= 5e6433246475e66462e1fea980688de96a049297 contains an unrestricted file upload caused by manipulation of the File argument in admin/add_logs.php, letting remote attackers upload arbitrary files, exploit requires no special privileges.