Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 297 of 767

  • 7.6 /10 High
    CVE-2026-93678 Auth required

    IBM Langflow OSS - Broken Access Control

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a broken access control vulnerability caused by improper authorization, letting remote authenticated attackers obtain sensitive information.

  • 7.7 /10 High
    CVE-2026-93677 Auth required

    IBM Langflow OSS - Information Disclosure

    IBM Langflow OSS 1.0.0 through 1.12.2 contains an information disclosure vulnerability caused by exposure of sensitive information, letting remote authenticated attackers obtain sensitive data, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-93675 No auth

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution vulnerability caused by dependency confusion, letting remote attackers execute arbitrary code, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-93674 PoC publicNo auth

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote attackers execute arbitrary code, exploit requires network access.

  • 8.5 /10 High
    CVE-2026-93449 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution caused by improper control of code generation, letting remote authenticated attackers execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-93447

    IBM Langflow OSS - Insecure Deserialization

    IBM Langflow OSS 1.0.0 through 1.12.2 contains an insecure deserialization vulnerability caused by malicious serialized cache values in Redis, letting attackers with server secret and Redis write access execute code with service privileges.

  • 8.1 /10 High
    CVE-2026-93445 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution caused by improper control of code generation, letting remote authenticated attackers execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-93443 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution caused by improper neutralization of special elements in code, letting remote authenticated attackers execute arbitrary code.

  • 7.6 /10 High
    CVE-2026-92543

    Docker Engine - Authentication Bypass

    Docker Engine contains a broken authentication caused by insecure DNS-based registry hostname classification, letting attackers bypass certificate verification and enable HTTP fallback, exploit requires attacker to control DNS responses.

  • 7.1 /10 High
    CVE-2026-92533 Auth required

    BugTracker.NET - Path Traversal

    BugTracker.NET contains a path traversal caused by improper validation of user-supplied file name paths in the file download component, letting authenticated remote attackers read arbitrary files outside intended directories.

  • 7.5 /10 High
    CVE-2026-92532 Auth required

    BugTracker.NET - Unrestricted File Upload

    BugTracker.NET contains an unrestricted file upload vulnerability in the attachment functionality caused by lack of proper file extension validation, letting authenticated administrators upload and execute malicious ASPX files, exploit requires administrator privileges.

  • 7.5 /10 High
    CVE-2026-92531 Auth required

    BugTracker.NET - Command Injection

    BugTracker.NET contains a command injection caused by improper validation of repository field in SVN integration, letting authenticated administrators execute arbitrary OS commands, exploit requires svn.exe installed and admin privileges.

  • 9.1 /10 Critical
    CVE-2026-92414 No auth

    Apache Jackrabbit - Authentication Bypass

    Apache Jackrabbit 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5 contain a session fixation vulnerability caused by attaching cached authenticated sessions on token matches without credential checks, letting attackers reuse sessions across users, exploit requires crafted token headers.

  • 7.2 /10 High
    CVE-2026-89417

    OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. - Stored XSS

    OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin <= 6.3.10 contains a stored XSS caused by insufficient input sanitization and output escaping in 's' Search Parameter via comments-atom Feed, letting unauthenticated attackers execute arbitrary scripts, exploit requires front-end server serving .tmp files without proper Content-Type headers.

  • 7.2 /10 High
    CVE-2026-89322 Auth required

    Vault - Broken Access Control

    Vault and Vault Enterprise < 2.1.2, 1.21.12, 1.20.17, 1.19.23 contain a broken access control caused by inconsistent evaluation of ACL policies against canonical resource and policy names, letting authenticated users bypass explicit deny restrictions and escalate privileges, exploit requires delegated permissions.