Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 362 of 767
- 7.6 /10 HighCVE-2026-104873 Auth required
LangGraph Python SDK - Broken Access Control
LangGraph Python SDK 0.1.45 to 0.4.4 contains a broken access control caused by resource-scoped authorization decorators ignoring the actions argument, letting authenticated users bypass permission checks to access others' resources, exploit requires use of affected decorators with actions.
- 7.5 /10 HighCVE-2026-104861 No auth
probe-image-size - Denial of Service
probe-image-size < 7.4.0 contains a denial of service caused by inefficient regex scanning in SVG parsers, letting attackers block the Node.js event loop with crafted input, exploit requires attacker-controlled input.
- 7.3 /10 HighCVE-2026-104859 No auth
Nx - Command Injection
Nx 21.4.0 to 22.7.8 and 23.0.0 to 23.1.1 contains a command injection caused by untrusted interpolation of release.docker.repositoryName and registryUrl in shell command strings, letting attackers execute commands with release job privileges, exploit requires attacker to control Nx configuration.
- 8.5 /10 HighCVE-2026-104854
Nx - Remote Code Execution
Nx 14.6.0 to 22.7.9 and 23.1.2 contains a code execution vulnerability caused by insecure Unix domain socket permissions in daemon and plugin workers, letting unprivileged local attackers execute code as the Nx user, exploit requires local access to the system.
- 8.8 /10 HighCVE-2026-104851 No auth
fsspec - Template Injection
fsspec 0.9.0 to 2026.6.0 contains a template injection caused by unrestricted jinja2.Template rendering in ReferenceFileSystem, letting attackers execute arbitrary Python code when opening crafted reference JSON documents, exploit requires attacker-controlled document input.
- 9.5 /10 CriticalCVE-2026-104849
Tinypool - Prototype Pollution
Tinypool < 2.1.2 contains a prototype pollution vulnerability caused by reading filename from a caller-supplied options object without own property check in pool.run, letting attackers load arbitrary JavaScript and read or modify task data, exploit requires prototype pollution.
- 9.8 /10 CriticalCVE-2026-104846 No auth
Seroval - Remote Code Execution
Seroval 0.12.0 to 1.6.2 contains a remote code execution caused by deserialization of attacker-controlled thenables in fromJSON, letting attackers trigger code execution via native Promise resolution, exploit requires crafted JSON input.
- 7.5 /10 HighCVE-2026-104845 No auth
Seroval - Denial of Service
Seroval before 1.6.3 contains a denial of service caused by unbounded allocation in deserializeTypedArray in fromJSON and fromCrossJSON trusting untrusted source values, letting attackers exhaust CPU or memory, exploit requires crafted JSON input.
- 7.3 /10 HighCVE-2026-104637 No auth
onetwothreeneth HospitalManagementSystem - Unrestricted File Upload
onetwothreeneth HospitalManagementSystem contains an unrestricted file upload vulnerability caused by improper validation of the "img" argument in php/controller.php functions, letting remote attackers upload arbitrary files, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-104611 Auth required
Tenda AC9 - Buffer Overflow
Tenda AC9 15.03.02.13 contains a stack-based buffer overflow caused by manipulation of the "netWanType" argument in /goform/fast_setting_internet_set POST request handler, letting remote attackers cause denial of service or execute code, exploit requires crafted request.
- 10.0 /10 CriticalCVE-2026-104610 No auth
Tenda HG7, HG9, HG10 - Buffer Overflow
Tenda HG7, HG9, and HG10 300001138_en_xpon contain a stack-based buffer overflow caused by manipulation of the "Ethtype" argument in /boaform/formLoopBack of Boa Web Server, letting remote attackers execute code, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-104609 No auth
onetwothreeneth HospitalManagementSystem - SQL Injection
onetwothreeneth HospitalManagementSystem contains a SQL injection caused by manipulation of user_id, patient_id, physician_id, discounts_id, or services_id arguments in edit_accounts.php get function, letting remote attackers execute arbitrary SQL queries, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-104472 No auth
YesWiki - Broken Access Control
YesWiki < 4.6.7 contains a broken access control caused by missing authorization in the attachment download handler, letting unauthenticated attackers bypass page read ACLs to download confidential attachments.
- 7.2 /10 HighCVE-2026-104471 Auth required
YesWiki - Unrestricted File Upload
YesWiki < 4.6.7 contains an unrestricted file upload vulnerability caused by lack of extension checks in Bazar CSV import preview, letting authenticated admins upload and execute remote PHP files, exploit requires admin authentication.
- 8.1 /10 HighCVE-2026-104467 No auth
YesWiki - Authorization Bypass
YesWiki < 4.6.7 contains an authorization bypass caused by improper checks in ApiService::isAuthorized() when public API mode is enabled, letting unauthenticated attackers call admin-only API routes and modify configurations or backups, exploit requires public API mode enabled.