Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 360 of 767

  • 7.1 /10 High
    CVE-2026-63578 No auth

    Legion of the Bouncy Castle Inc. bc-csharp - Denial of Service

    Legion of the Bouncy Castle Inc. bc-csharp < 2.7.0 contains a denial of service caused by unbounded iteration count in password-based private-key decryption (PbeUtilities.GenerateCipherParameters), letting attackers cause CPU exhaustion via crafted encrypted private keys, exploit requires supplying a crafted encrypted private key.

  • 8.2 /10 High
    CVE-2026-63577

    Legion of the Bouncy Castle Inc. bc-csharp - Authentication Bypass

    Legion of the Bouncy Castle Inc. bc-csharp < 2.7.0 contains an improper certificate validation vulnerability caused by incorrect directoryName name-constraint checks in PkixNameConstraintValidator.WithinDNSubtree, letting attackers with control over name-constrained intermediate CAs bypass PKIX path validation, exploit requires attacker to control or have certificates issued by a name-constrained intermediate CA.

  • 8.2 /10 High
    CVE-2026-63576 No auth

    Legion of the Bouncy Castle Inc. bc-csharp - Authentication Bypass

    Legion of the Bouncy Castle Inc. bc-csharp < 2.7.0 contains an improper certificate validation caused by incorrect host extraction in PkixNameConstraintValidator, letting attackers bypass URI name constraints during certification path validation, exploit requires crafted certificates with specific subjectAltName URIs.

  • 7.1 /10 High
    CVE-2026-61374 Auth required

    Apache Thrift - Denial of Service

    Apache Thrift Java bindings before 0.25.0 contain an allocation of resources without limits or throttling vulnerability, letting attackers exhaust resources, exploit requires no special privileges.

  • 8.7 /10 High
    CVE-2026-61373 No auth

    Apache Thrift - Denial of Service

    Apache Thrift Java TSaslNonblockingServer before 0.25.0 contains an allocation of resources without limits or throttling vulnerability, letting attackers cause denial of service by exhausting resources, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-59265 PoC publicNo auth

    Apache OpenOffice - Remote Code Execution

    Apache OpenOffice <= 4.1.16 contains a remote code execution caused by Java integration processing crafted untrusted documents, letting attackers execute arbitrary code when opened by users, exploit requires user to open malicious document.

  • 9.8 /10 Critical
    CVE-2026-51922 No auth

    agentscope - Command Injection

    agentscope v1.0.20 contains a command injection caused by unsanitized input in execute_shell_command in src/agentscope/tool/_coding/_shell.py, letting attackers execute arbitrary code or commands remotely, exploit requires attacker control of input.

  • 9.8 /10 Critical
    CVE-2026-51918 No auth

    FinRobot - Command Injection

    FinRobot 1.0.0 contains a command injection caused by unsafe code execution in CodingUtils.create_file_with_code(), letting attackers execute arbitrary commands remotely, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-51917 No auth

    FinRobot - Command Injection

    FinRobot v1.0.0 contains a command injection caused by improper input handling in CodingUtils.modify_code, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-51916 No auth

    TransformerOptimus SuperAGI - Broken Access Control

    TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability caused by missing authentication and ownership verification in delete_user_knowledge in superagi/controllers/knowledges.py, letting attackers delete knowledge objects without authorization, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-51915 No auth

    TransformerOptimus SuperAGI - Broken Access Control

    TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability caused by lack of organization ownership verification in tool controller endpoints, letting remote authenticated attackers read or modify other organizations' tool metadata.

  • 8.8 /10 High
    CVE-2026-51914 Auth required

    TransformerOptimus SuperAGI - Broken Access Control

    TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability caused by lack of verification of agent_id or agent_execution_id ownership in agent_template controller, letting authenticated users access unauthorized agent templates, exploit requires user authentication.

  • 9.8 /10 Critical
    CVE-2026-51911

    Vanna - Code Injection

    Vanna v2.0.2 contains a code injection vulnerability caused by unsafe handling in VannaBase.get_plotly_figure, letting attackers execute arbitrary code or commands remotely, exploit requires accessible vulnerable entry point.

  • 8.1 /10 High
    CVE-2026-51907 Auth required

    TaskingAI - Path Traversal

    TaskingAI v0.3.0 contains a path traversal vulnerability caused by manipulation of the project_id parameter in the QR Code Generator plugin's save_base64_image function, letting attackers write image files to arbitrary server locations, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-51906 No auth

    TaskingAI - Path Traversal

    TaskingAI v0.3.0 contains a path traversal caused by manipulation of the project_id parameter in the DALL-E 3 image generation tool save_url_image function, letting attackers write files to arbitrary locations on the server filesystem, exploit requires crafted request.