Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 290 of 767
- 7.8 /10 HighCVE-2026-11318 PoC publicAuth required
Deskin - Privilege Escalation
Deskin through 3.3.4.3 contains a privilege escalation caused by lack of authentication in the com.deskin.service.installer XPC service, letting local unprivileged attackers execute arbitrary installer packages as root, exploit requires local access.
- 7.1 /10 HighCVE-2026-107802
SumatraPDF - Command Injection
SumatraPDF <= 3.6.1 contains a command injection caused by incomplete quote-only escaping in translation text embedding in Windows command lines, letting attackers inject CLI flags when specific backends are used, exploit requires agentic CLI backend installation.
- 7.8 /10 HighCVE-2026-107782 Auth required
System Informer - Broken Access Control
System Informer < 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper, letting local attackers execute code as SYSTEM by connecting from any Authenticode-signed process.
- 7.4 /10 HighCVE-2026-107781 No auth
Dromara Skyeye - Server-Side Request Forgery & Broken Access Control
Dromara Skyeye contains a server-side request forgery and missing authorization vulnerability in OnlyOffice save callback editUploadOfficeFileById, letting unauthenticated attackers fetch internal URLs and overwrite user files, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-107780 No auth
Dromara Skyeye - Command Injection
Dromara Skyeye contains a command injection caused by improper sanitization of the format parameter in the unauthenticated /post/TtsController/textToSpeech endpoint, letting remote attackers execute OS commands as the Skyeye service account on Windows, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-107779 No auth
Dromara Skyeye - Authentication Bypass
Dromara Skyeye contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false), letting unauthenticated attackers execute commands or stop/delete jobs on the executor host via crafted POST requests.
- 7.1 /10 HighCVE-2026-107734 No auth
SumatraPDF - Command Injection
SumatraPDF <= 3.5.2 contains a command injection caused by unsafe substitution of attacker-controlled SyncTeX source filename in external editor command line, letting attackers inject command-line flags via crafted .synctex.gz files, exploit requires user to open PDF and invoke inverse search with configured external editor.
- 8.4 /10 HighCVE-2026-107732 No auth
SumatraPDF - Command Injection
SumatraPDF <= 3.6.1 contains a command injection caused by untrusted document paths and PDF link targets being interpreted as trusted tip markup in ParseTip(), letting attackers execute local programs in the user's context, exploit requires user interaction.
- 7.5 /10 HighCVE-2026-107728 No auth
Strawberry GraphQL - Broken Access Control
Strawberry GraphQL 0.217.0 < 0.326.1 contains a broken access control caused by improper handling of awaitable return values in synchronous PermissionExtension.resolve(), letting attackers bypass permission checks, exploit requires synchronous field resolvers with custom has_permission() returning awaitable.
- 9.3 /10 CriticalCVE-2026-107726 No auth
Hazelcast - Information Disclosure & Remote Code Execution
Hazelcast < 5.4.5, < 5.5.10, and < 5.6.1 contain an information disclosure and potential remote code execution caused by improper validation of data from malicious clients, letting attackers read arbitrary memory and crash or corrupt cluster members, exploit requires attacker to connect to the cluster.
- 8.7 /10 HighCVE-2026-107725 Auth required
Hazelcast - Remote Code Execution
Hazelcast < 5.4.5, < 5.5.10, and < 5.6.1 contain a remote code execution caused by missing authorization checks in the IMap Predicates API, letting malicious clients with limited privileges execute arbitrary code on cluster members, exploit requires client access with limited privileges.
- 7.4 /10 HighCVE-2026-107724
fast-jwt - Authentication Bypass
fast-jwt 6.2.4 contains a broken authentication caused by misclassification of raw serialized public JWK or JWKS JSON as HMAC secret in src/crypto.js, letting attackers create tokens with arbitrary claims, exploit requires knowledge of exact serialized public-key bytes.
- 8.1 /10 HighCVE-2026-107723 Auth required
fast-jwt - Authentication Bypass
fast-jwt < 6.3.0 contains a broken authentication caused by accepting JSON array payloads in JWTs without proper claim validation, letting attackers bypass expiry, issuer, audience, subject, revocation, and replay protections, exploit requires attacker to produce or influence a validly signed token.
- 9.8 /10 CriticalCVE-2026-107722
fast-jwt - Authentication Bypass
fast-jwt 6.2.0 to 6.3.0 contains an authentication bypass caused by misclassification of RSA public-key text as HMAC secret due to improper PEM header detection, letting attackers sign arbitrary HS256 claims, exploit requires attacker knowledge of public key bytes.
- 7.4 /10 HighCVE-2026-107720 No auth
fast-jwt - Authentication Bypass
fast-jwt < 6.3.1 contains an authentication bypass caused by accepting unsigned JWTs when key is empty or null and algorithms allowlist is non-empty, letting attackers bypass signature verification and submit arbitrary claims.