Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 29 of 677

  • 7.3 /10 High
    CVE-2026-110668 No auth

    cemtan sar2html - SQL Injection

    cemtan sar2html 4.0.0 contains a sql injection caused by manipulation of the "sort" argument in the index function of sar2html.py, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-110667 No auth

    cemtan sar2html - Hardcoded Credentials

    cemtan sar2html 4.0.0 contains hardcoded credentials caused by manipulation of the SECRET_KEY argument in sar2html.py, letting remote attackers gain unauthorized access, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-110650 No auth

    thumbnail Python package - Command Injection

    thumbnail Python package through 1.5 contains a command injection caused by unsanitized file paths in generate_thumbnail(), letting attackers execute OS commands with Python process privileges, exploit requires attacker control of file names.

  • 9.8 /10 Critical
    CVE-2026-110649 No auth

    Stills - Command Injection

    Stills before 25.24.2 contains a command injection caused by crafted media file paths with shell metacharacters, letting attackers execute OS commands with Node.js process privileges, exploit requires crafted media file names.

  • 7.8 /10 High
    CVE-2026-110648 No auth

    @offactory/compress-fonts - Command Injection

    @offactory/compress-fonts < 1.1.1 contains a command injection caused by unquoted font path interpolation in FontForge command via child_process.execSync, letting attackers execute shell commands with Node.js process privileges, exploit requires crafted font file names.

  • 7.8 /10 High
    CVE-2026-110647 No auth

    Turnpress - Command Injection

    Turnpress through 0.4.2 contains a command injection caused by shell metacharacters in .docx file names processed by convertDocxToHtml function invoking pandoc with shell:true, letting attackers execute arbitrary shell commands with victim's privileges, exploit requires crafted .docx file names.

  • 8.1 /10 High
    CVE-2026-110646 No auth

    Beganovich snappdf - Command Injection

    Beganovich snappdf > 1.1.0 < 6.1.0 contains a command injection caused by unescaped cmd.exe metacharacters in setUrl() passed to PHP exec(), letting attackers execute OS commands on Windows, exploit requires crafted URL input.

  • 9.8 /10 Critical
    CVE-2026-110645 No auth

    Video-stitch - Command Injection

    Video-stitch < 2.0.0-beta.1 contains a command injection caused by unquoted file names interpolated into shell-executed ffmpeg commands, letting attackers execute OS commands with Node.js process privileges, exploit requires attacker to influence file names.

  • 9.8 /10 Critical
    CVE-2026-110644 No auth

    nodejs-whisper - Command Injection

    nodejs-whisper through 0.3.1 contains a command injection caused by improper sanitization of audio file paths in convertToWavType(), letting attackers execute OS commands with Node.js process privileges by supplying crafted file names.

  • 9.8 /10 Critical
    CVE-2026-110643 No auth

    transcribe2texts - Command Injection

    transcribe2texts through 1.0.6 contains a command injection caused by unescaped audioPath values in transcribeAudio(), letting attackers execute OS commands with Node.js process privileges, exploit requires crafted audioPath input.

  • 7.8 /10 High
    CVE-2026-110642 No auth

    xhtml2pdf - Command Injection

    xhtml2pdf < 0.2.19 contains a command injection caused by unescaped file names interpolated into os.system in pisa.startViewer(), letting attackers execute OS commands as the invoking user, exploit requires crafted input file name with shell metacharacters.

  • 8.8 /10 High
    CVE-2026-110641 Auth required

    @runnerty/executor-decompress - Command Injection

    @runnerty/executor-decompress <= 3.1.1 contains a command injection caused by improper sanitization of archive file names in compress_file, letting attackers execute OS commands with Runnerty process privileges, exploit requires attacker to drop crafted file in watched directory.

  • 9.8 /10 Critical
    CVE-2026-110640 No auth

    Whisper-node - Command Injection

    Whisper-node <= 1.1.1 contains a command injection caused by improper sanitization of filePath or whisperOptions.language in whisper(), letting attackers execute OS commands with Node.js process privileges, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-110639 No auth

    @mborne/extract - Command Injection

    @mborne/extract < 0.2.1 contains a command injection caused by unquoted shelljs exec() usage in archivePath or targetDir options, letting attackers execute OS commands with Node.js process privileges, exploit requires attacker control of these options.

  • 9.8 /10 Critical
    CVE-2026-110638 No auth

    doc-recog - Command Injection

    doc-recog through 1.1.6 contains a command injection caused by improper sanitization of document paths in recog() or tag(), letting attackers execute OS commands with Node.js process privileges, exploit requires crafted document paths.