Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 396 of 767

  • 7.5 /10 High
    CVE-2026-103088 No auth

    Handlebars.java - Path Traversal

    Handlebars.java before 4.5.5 contains a path traversal caused by inconsistent percent-encoding validation in template location handling, letting attackers read files outside the configured template base directory, exploit requires a Spring MVC application with file: template prefix and request-derived view name.

  • 9.0 /10 Critical
    CVE-2026-103056 Auth required

    AiSOC - Command Injection

    AiSOC < 12.0.0 contains a command injection caused by unescaped action parameters in crowdstrike_rtr.py and endpoint.py, letting authenticated users execute arbitrary commands with SYSTEM or root privileges on managed endpoints.

  • 7.5 /10 High
    CVE-2026-103055

    AiSOC - Authentication Bypass

    AiSOC < 12.0.0 contains a broken authentication caused by use of a hard-coded constant for JWT verification in realtime WebSocket and SSE service, letting unauthenticated attackers access cross-tenant live data, exploit requires AISOC_REALTIME_JWT_SECRET environment variable unset.

  • 7.1 /10 High
    CVE-2026-103054 Auth required

    AiSOC - Authorization Bypass

    AiSOC < 12.0.0 contains an authorization bypass caused by improper validation in the MSSP module's add_tenants_to_portfolio endpoint, letting authenticated users add arbitrary tenants to portfolios they own and access sensitive data.

  • 7.5 /10 High
    CVE-2026-103000 No auth

    pypdf - Denial of Service

    pypdf < 6.19.0 contains a denial of service caused by unusually large alphabetical page-label values in _page_labels.py, letting attackers consume excessive memory and potentially make the application unavailable, exploit requires crafted PDF input.

  • 7.5 /10 High
    CVE-2026-102999 No auth

    pypdf - Denial of Service

    pypdf < 6.19.0 contains a denial of service caused by reparsing the full attachment list for each content lookup in the dictionary-based attachments API, letting attackers cause long runtimes, exploit requires crafted PDF with many embedded files.

  • 7.5 /10 High
    CVE-2026-102998 No auth

    pypdf - Denial of Service

    pypdf < 6.19.0 contains a denial of service caused by inefficient appearance-stream generation in _appearance_stream.py when processing crafted PDFs with form field values, letting attackers cause excessive runtimes and application unavailability, exploit requires crafted PDF with form fields.

  • 7.5 /10 High
    CVE-2026-102997 No auth

    pypdf - Denial of Service

    pypdf prior to 6.18.1 contains a denial of service caused by inefficient byte-by-byte decompression of malformed /FlateDecode streams in filters.py, letting attackers cause long runtimes and application unavailability, exploit requires crafted PDF input.

  • 7.5 /10 High
    CVE-2026-102996 No auth

    pypdf - Denial of Service

    pypdf < 6.18.1 contains a memory exhaustion vulnerability caused by processing an unusually large /Widths array in TrueType or Type1 simple fonts, letting attackers cause excessive memory consumption during text extraction, exploit requires crafted PDF.

  • 7.5 /10 High
    CVE-2026-102995 No auth

    pypdf - Denial of Service

    pypdf < 6.18.1 contains a resource consumption vulnerability caused by parsing oversized /ToUnicode mapping tokens in font objects, letting attackers cause excessive memory use during text extraction, exploit requires crafted PDF.

  • 7.5 /10 High
    CVE-2026-102994 No auth

    pypdf - Denial of Service

    pypdf < 6.18.0 contains a denial of service caused by crafted PDFs with long indirect-object identifiers or generation-number tokens without whitespace, letting attackers cause long runtimes and application unavailability, exploit requires crafted PDF input.

  • 7.5 /10 High
    CVE-2026-102993 No auth

    pypdf - Denial of Service

    pypdf < 6.17.0 contains a denial of service caused by excessively large Roman page-label values in _page_labels.py, letting attackers consume large memory and potentially make the application unavailable, exploit requires crafted PDF.

  • 7.3 /10 High
    CVE-2026-102913 No auth

    SourceCodester Car Driving School Management System - SQL Injection

    SourceCodester Car Driving School Management System 1.0 contains a SQL injection caused by manipulation in /classes/Master.php?f=save_enrollment, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-102911 Auth required

    zosmaai pi-llm-wiki - Command Injection

    zosmaai pi-llm-wiki <= 0.11.7 contains a command injection caused by manipulation of the "url" argument in mcp/index.ts component wiki_capture_source MCP tool, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-102910 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "test_id" argument in /reviewer_0/admins/assessments/examproper/exam-delete.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.