Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 409 of 695
- 7.5 /10 HighCVE-2026-59990 No auth
Jawn - Denial of Service
Jawn < 1.7.0 contains a denial of service caused by lack of depth limit in JSON parsing, letting remote attackers exhaust JVM heap via deeply nested JSON, exploit requires submission of untrusted JSON.
- 10.0 /10 CriticalCVE-2026-59167 No auth
SunEditor - Stored XSS
SunEditor < 2.47.11 contains a stored XSS caused by inconsistent sanitization of namespaced or custom HTML elements in src/lib/core.js, letting attackers execute scripts in the browser via crafted content, exploit requires user interaction.
- 8.7 /10 HighCVE-2026-55610 Auth required
InvoiceShelf - Broken Access Control
InvoiceShelf < 2.4.1 contains a broken access control vulnerability caused by improper user ownership verification in multi-company installations, letting company owners read and overwrite user accounts across companies, exploit requires owner privileges.
- 7.4 /10 HighCVE-2026-42801 Auth required
ASR Crane Falcon - Denial of Service
ASR Crane Falcon on Linux contains a null pointer dereference vulnerability caused by improper pointer manipulation in as_rrc module (3g.mod/lib/src/urrsir.c), letting attackers cause denial of service, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-31377
Apache Doris - Authentication Bypass
Apache Doris 2.0.0 to 4.1.4 contains an improper authentication vulnerability caused by relying on client-supplied node information for authentication in the Frontend meta service, letting unauthenticated remote attackers access internal metadata endpoints, exploit requires specific network configurations.
- 7.5 /10 HighCVE-2026-19888 No auth
PgBouncer - Denial of Service
PgBouncer through 1.25.2 contains a null pointer dereference caused by missing validation of a mandatory attribute in the SCRAM client-final-message parser, letting unauthenticated remote attackers cause a denial of service by crashing the process, exploit requires no valid account.
- 9.9 /10 CriticalCVE-2026-19599 Auth required
ZohoCorp ManageEngine OpManager MSP - Remote Code Execution
ZohoCorp ManageEngine OpManager MSP <= 12.8.709 contains a remote code execution caused by a flaw in the Notification Profile module, letting remote attackers execute arbitrary code, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-19438 No auth
ABB Mint Workbench I - Path Traversal
ABB Mint Workbench I <= 5876 contains a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory, letting attackers access unauthorized files, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-19179 No auth
IBM Financial Transaction Manager - SQL Injection
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a SQL injection caused by improper neutralization of special elements in a boolean expression, letting remote attackers manipulate database queries, exploit requires network access.
- 8.1 /10 HighCVE-2026-19125 PoC publicNo auth
EthPress Web3 Login - Authentication Bypass
EthPress – Web3 Login WordPress plugin <= 2.3.5 contains an authentication bypass caused by missing return in signature verification in app/Login.php, letting unauthenticated attackers log in as any user, exploit requires crafted signature.
- 7.3 /10 HighCVE-2026-18875 No auth
IBM Financial Transaction Manager - Template Injection
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a template injection caused by unauthenticated runbook upsert in the FTM AI agent server, letting unauthenticated attackers trigger unauthorized payment actions or exfiltrate payment data.
- 9.3 /10 CriticalCVE-2026-18872 No auth
IBM Financial Transaction Manager (FTM) - Stored XSS
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a stored cross-site scripting caused by script injection in the NetworkAcknowledgement React component, letting authenticated operators have their sessions hijacked and perform unauthorized payment actions, exploit requires operator authentication.
- 8.8 /10 HighCVE-2026-18490
IBM Financial Transaction Manager - Remote Code Execution
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an insecure deserialization vulnerability in PayDir Business Rules Manager RMI SSL endpoint, letting adjacent-network attackers execute arbitrary code remotely, exploit requires network adjacency.
- 7.3 /10 HighCVE-2026-18185 No auth
IBM Financial Transaction Manager (FTM) for RedHat OpenShift - Broken Access Control
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken access control vulnerability caused by missing authentication for a critical function, letting remote attackers access sensitive information and modify system configurations, exploit requires no special privileges.
- 7.4 /10 HighCVE-2026-18184 No auth
IBM Financial Transaction Manager (FTM) - XML External Entity Injection
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an XML external entity injection flaw caused by improper XML input processing, letting remote attackers obtain sensitive information, exploit requires crafted XML input.