Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 364 of 767
- 7.5 /10 HighCVE-2026-104423 No auth
Zebra - Denial of Service
Zebra (zebrad) < 6.2.1 contains an asymmetric resource consumption vulnerability caused by unauthenticated peers pushing invalid Halo2 proofs in V6 mempool transactions, letting attackers stall block verification by flooding verification queue, exploit requires network access.
- 7.5 /10 HighCVE-2026-104422 No auth
Zebra - Denial of Service
Zebra (zebrad) < 6.3.0 contains a denial of service caused by unvalidated coinbase scriptSig height in block sync download path, letting malicious peers delay block discovery without penalty, exploit requires network interaction with peer.
- 7.2 /10 HighCVE-2026-104418 Auth required
Ghost - Remote Code Execution
Ghost > 6.10.3 < 6.64.0 contains a remote code execution caused by abuse of theme translation file loading, letting authenticated administrators execute arbitrary code on the server, exploit requires administrator access.
- 7.5 /10 HighCVE-2026-104416 Auth required
Ghost - Broken Access Control
Ghost >4.39.0 and <6.64.0 contains an information disclosure and privilege escalation vulnerability caused by improper access control in the Admin API, letting staff users view secret tokens and escalate privileges by accepting pending invites, exploit requires staff user with invite viewing permission.
- 8.1 /10 HighCVE-2026-104414 No auth
Ghost - Stored XSS
Ghost 2.5.0 < 6.64.0 contains a stored XSS caused by untrusted script injection via oEmbed photo responses in post content, letting attackers compromise admin sessions through editor, site, and emails, exploit requires embedding malicious URLs.
- 7.3 /10 HighCVE-2026-104413 Auth required
Ghost - Stored XSS
Ghost 5.94.0 < 6.64.0 contains a stored XSS caused by abuse of bookmark card image fetching allowing staff users to host arbitrary HTML, letting attackers compromise admin sessions, exploit requires attacker to be a staff user.
- 7.3 /10 HighCVE-2026-104411 Auth required
Ghost - Stored XSS
Ghost 6.22.1 < 6.64.0 contains a stored XSS caused by uploading files with extension-derived content types on the default local storage adapter, letting attackers compromise admin sessions, exploit requires attacker to be staff user.
- 7.5 /10 HighCVE-2026-104410 No auth
SiYuan - Information Disclosure
SiYuan before 3.8.5 contains an information disclosure vulnerability caused by improper access control in /api/export/preview endpoint, letting publish readers access password-protected and publish-disabled database rows, exploit requires attacker to be a publish reader.
- 7.3 /10 HighCVE-2026-104123 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "Title" argument in /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-104120 No auth
modelcontextprotocol mcp-server-fetch & mcp-server-everything - Server-Side Request Forgery
modelcontextprotocol mcp-server-fetch and mcp-server-everything <= 2026.6.4 contain a server-side request forgery caused by manipulation of the url/path argument in fetch_url function of Fetch Tool, letting remote attackers make arbitrary requests, exploit requires no special privileges.
- 7.8 /10 HighCVE-2026-104026 No auth
Sapling SCM - Command Injection
Sapling SCM < 0.2.20260929-102736 contains a command injection caused by control characters embedded in Git subtree URLs, letting attackers trigger code execution during read-only actions, exploit requires cloning a malicious repository.
- 9.0 /10 CriticalCVE-2026-104019 Auth required
Amazon SageMaker Distribution - OS Command Injection
Amazon SageMaker Distribution 2.x < 2.14.12, 3.x < 3.9.12, 4.0.x < 4.0.11, 4.1.x < 4.1.11, 4.2.x < 4.2.8, 4.3.x < 4.3.5, and 4.4.x < 4.4.3 contains an OS command injection caused by unneutralized interpolation of crafted connection resource property in Studio Space startup validation script, letting authenticated remote users with project contributor permissions execute arbitrary commands and obtain temporary execution role credentials, exploit requires project contributor permissions.
- 7.6 /10 HighCVE-2026-103958 Auth required
Loom for AWS - Server-Side Request Forgery
Loom for AWS < 1.7.0 contains a server-side request forgery caused by improper validation of connection addresses in tool server and remote agent handling, letting authenticated remote users obtain container role credentials and read internal network responses, exploit requires authentication.
- 10.0 /10 CriticalCVE-2026-103956 PoC publicNo auth
Loom for AWS - Authentication Bypass
Loom for AWS < 1.6.1 contains a broken authentication caused by missing authentication for critical functions in the authentication dependency, letting remote actors obtain super-admin authority over the agent control plane, exploit requires no identity provider configured.
- 7.5 /10 HighCVE-2026-103885 No auth
Apache Directory LDAP API - Denial of Service
Apache Directory LDAP API >= 2.1.0 < 2.1.9 contains an asymmetric resource consumption vulnerability caused by processing malformed Telephone Numbers, letting attackers cause high CPU usage, exploit requires sending crafted input.