Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 304 of 767

  • 7.5 /10 High
    CVE-2026-107212 PoC publicNo auth

    Excelize - Denial of Service

    Excelize 2.1.0 to 2.11.0 contains a denial of service caused by improper row number limit checks in Rows.Columns and Rows.Next, letting attackers consume CPU resources by crafted worksheets, exploit requires processing crafted Excel files.

  • 7.2 /10 High
    CVE-2026-107207 No auth

    LMCache - Server Side Request Forgery

    LMCache <= 0.5.5 contains a server-side request forgery caused by improper validation in the frontend monitoring service, letting unauthenticated attackers bypass proxy allowlist to access internal hosts and tamper nodes, exploit requires ability to register arbitrary hosts via POST /api/proxies.

  • 9.4 /10 Critical
    CVE-2026-107206 No auth

    LMCache - Authentication Bypass

    LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server, letting remote unauthenticated attackers access management endpoints and manipulate cache and configuration.

  • 8.6 /10 High
    CVE-2026-107205 No auth

    LMCache - Authentication Bypass

    LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator's HTTP fleet control API, letting remote unauthenticated attackers access and manipulate instances, quotas, events, and directory keys, exploit requires default API exposure on all interfaces.

  • 9.8 /10 Critical
    CVE-2026-107204 No auth

    LMCache - Remote Code Execution

    LMCache <= 0.5.5 contains a remote code execution caused by unauthenticated script posting to /run_script endpoint, letting remote attackers execute arbitrary Python code, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-107202 No auth

    h-ui - Command Injection

    h-ui v0.0.25 and below contains a command injection caused by improper validation of the listen configuration field in the administrative API, letting authenticated administrators execute arbitrary OS commands as root, exploit requires administrator authentication.

  • 9.2 /10 Critical
    CVE-2026-107194 No auth

    Sungrow iSolarCloud - Authentication Bypass

    Sungrow iSolarCloud < 2026 contains an authentication bypass caused by improper handling of "login_type":"5" in login requests, letting attackers bypass authentication and take over accounts, exploit requires user email address.

  • 8.1 /10 High
    CVE-2026-107183 No auth

    llama.cpp - Use After Free

    llama.cpp before b11393 contains a use-after-free and double free vulnerability caused by a dangling current_tool pointer in common_chat_peg_mapper::map, letting unauthenticated remote attackers corrupt heap memory via crafted POST /completion requests.

  • 8.1 /10 High
    CVE-2026-107181 PoC publicNo auth

    Telegram Desktop - Authentication Bypass

    Telegram Desktop < 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox, letting remote attackers inject OPEN: records via crafted tg:// links to upload local files and enable account takeover, exploit requires crafted tg:// links with unescaped semicolons.

  • 7.1 /10 High
    CVE-2026-107180 Auth required

    MISP - Authentication Bypass

    MISP < 2.5.48 contains a broken authentication caused by improper enforcement of mandatory TOTP two-factor authentication on non-browser requests, letting authenticated users bypass TOTP enrollment and retain full access, exploit requires user authentication.

  • 7.5 /10 High
    CVE-2026-107161

    Cyrus SASL - Buffer Overflow

    Cyrus SASL contains a heap-based buffer overflow caused by incorrect buffer size calculation in the DIGEST-MD5 plugin's add_to_challenge() function, letting malicious or on-path servers crash the client by supplying crafted challenge fields, exploit requires attacker-controlled server.

  • 9.3 /10 Critical
    CVE-2026-107104 No auth

    ERP system - Insecure Deserialization

    ERP system contains an insecure deserialization vulnerability caused by unsafe deserialization of user-controlled data, letting unauthenticated remote attackers execute arbitrary code or manipulate data, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-107103 No auth

    ERP system - SQL Injection

    ERP system contains a SQL injection caused by insufficient validation and parameterization of user input in an API endpoint, letting unauthenticated remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-107102 No auth

    ERP system - Authentication Bypass

    ERP system contains an authentication bypass caused by improper validation of payment callback parameters and inadequate authentication controls in API endpoint, letting unauthenticated remote attackers gain unauthorized access to user accounts, exploit requires crafted parameter manipulation.

  • 7.1 /10 High
    CVE-2026-106560 Auth required

    Backstage @backstage/plugin-scaffolder-backend-module-confluence-to-markdown - Path Traversal

    Backstage @backstage/plugin-scaffolder-backend-module-confluence-to-markdown < 0.3.25 contains a path traversal caused by improper repository path validation in scaffolder backend module, letting authenticated users write generated content outside task workspace, exploit requires authentication and template execution.