Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 322 of 767
- 7.8 /10 HighCVE-2026-25291
Generic Product - Memory Corruption
A memory corruption vulnerability exists due to lack of proper synchronization mechanisms when performing concurrent operations on shared memory page lists, letting attackers cause memory corruption, exploit requires concurrent access.
- 7.8 /10 HighCVE-2026-25267
Memory Corruption - Memory Corruption
A memory corruption vulnerability occurs when a non-secure loader rewrites page tables before secure memory initialization, letting attackers cause memory corruption, exploit requires specific loader behavior.
- 7.5 /10 HighCVE-2026-106550
Mozilla Node-convict - Denial of Service
Mozilla Node-convict >= 6.2.2 contains a denial of service caused by incomplete prototype-pollution protections in config.set(), letting attackers overwrite core JavaScript methods causing persistent process failures, exploit requires attacker-controlled keys forwarded to config.set().
- 8.5 /10 HighCVE-2026-106547 No auth
HDF5 - Buffer Overflow
HDF5 < 2.2.0 contains a heap-based buffer overflow caused by inconsistent metadata handling in H5VM_array_fill() during dataset unallocated chunk reads, letting remote attackers cause crashes or execute arbitrary code with crafted files.
- 8.4 /10 HighCVE-2026-106512 Auth required
CakePHP CakeResponse - Stored XSS
CakePHP CakeResponse::download() contains a stored cross-site scripting vulnerability caused by unsanitized filename interpolation in Content-Disposition header, letting authenticated users inject scripts via crafted filenames, exploit requires authenticated user to upload or create attachments with malicious filenames.
- 9.8 /10 CriticalCVE-2026-106511 No auth
MultiversX multisig-improved - Broken Access Control
MultiversX multisig-improved contains a broken access control vulnerability caused by missing independent authorization checks, letting attackers with Proposer role move funds alone, exploit requires Proposer role.
- 7.7 /10 HighCVE-2026-106509 PoC publicAuth required
Backstage @backstage/plugin-techdocs-node - Command Injection
Backstage @backstage/plugin-techdocs-node < 1.14.6 contains a command injection caused by improper validation of mkdocs theme configuration in techdocs, letting users with write access to a registered repository execute arbitrary code during documentation build, exploit requires write access to repository.
- 7.7 /10 HighCVE-2026-106505 Auth required
Backstage @backstage/plugin-techdocs-node - Remote Code Execution
Backstage @backstage/plugin-techdocs-node < 1.14.6 and < 1.15.4 contains a remote code execution caused by bypass of MkDocs configuration sanitizer in techdocs backend, letting users with commit access execute arbitrary code during documentation generation, exploit requires commit access to repository.
- 8.1 /10 HighCVE-2026-106503 Auth required
Backstage @backstage/plugin-scaffolder-backend - Authorization Bypass
Backstage @backstage/plugin-scaffolder-backend < 3.3.1, < 3.4.1, < 4.0.3, and < 4.1.0 contains an authorization bypass caused by improper scaffolder action input validation, letting authenticated users bypass action restrictions and access unauthorized repositories, exploit requires user authentication.
- 9.6 /10 CriticalCVE-2026-106501 Auth required
Backstage @backstage/plugin-scaffolder-backend - Information Disclosure
Backstage @backstage/plugin-scaffolder-backend < 3.3.1, < 3.4.1, < 4.0.3, < 4.1.0 contains a sensitive information exposure caused by unauthorized access to another user's Scaffolder task data, letting authenticated users disclose internal execution data including credentials, exploit requires user authentication.
- 8.5 /10 HighCVE-2026-106500 Auth required
Backstage @backstage/plugin-scaffolder-backend - Broken Access Control
Backstage @backstage/plugin-scaffolder-backend < 3.3.1, < 3.4.1, < 4.0.3, < 4.1.0 contains a broken access control caused by improper task state validation in scaffolder backend, letting authenticated users with scaffolder task permissions modify backend files, exploit requires specific timing and writable backend files.
- 7.7 /10 HighCVE-2026-106498 Auth required
Backstage @backstage/plugin-catalog-backend - Broken Access Control
Backstage @backstage/plugin-catalog-backend < 3.5.1, 3.6.2, 3.7.2, 3.8.2, 3.9.1 contains an information disclosure caused by improper URL validation in catalog entity placeholder resolution, letting authenticated users access unintended data under certain configurations, exploit requires user authentication.
- 7.6 /10 HighCVE-2026-106492
Backstage @backstage/backend-defaults - Broken Access Control
Backstage @backstage/backend-defaults < 0.16.1 and < 0.17.8 contains a broken access control caused by improper preservation of access restrictions during service credential delegation, letting external services bypass restrictions and perform unauthorized operations, exploit requires configured service credentials with access restrictions.
- 8.1 /10 HighCVE-2026-106488 Auth required
Backstage @backstage/plugin-auth-backend-module-oidc-provider - Authentication Bypass
Backstage @backstage/plugin-auth-backend-module-oidc-provider < 0.4.20 contains an authentication bypass caused by improper handling of unverified email addresses in OIDC provider, letting authenticated provider users assume other catalog identities, exploit requires OIDC email-based identity resolution with unverified emails allowed.
- 8.5 /10 HighCVE-2026-106486 Auth required
Backstage @backstage/plugin-scaffolder-backend-module-bitbucket - Path Traversal
Backstage @backstage/plugin-scaffolder-backend-module-bitbucket-cloud < 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server < 0.2.25 contain a path traversal caused by insufficient validation of filesystem paths in Bitbucket pull-request Scaffolder actions, letting authenticated users affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability.