Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 414 of 695
- 9.8 /10 CriticalCVE-2026-88416 No auth
MCMS - SQL Injection
MCMS 6.1.1 through 6.2.1 contains a sql injection caused by improper sanitization in the custom model/form import feature, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.
- 8.7 /10 HighCVE-2026-88415 Auth required
MCMS - Stored XSS
MCMS 6.1.1 through 6.2.1 contains a stored XSS caused by exclusion of the article content field 'contentDetails' from the global XSS filter, letting attackers execute scripts on users, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-88414 No auth
MCMS - SQL Injection
MCMS 6.1.1 through 6.2.1 contains a sql injection caused by unsanitized input in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do), letting attackers execute arbitrary SQL commands remotely, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-88345 No auth
flatcc - Out of Bounds Read
flatcc 4c3b999e contains an out-of-bounds read caused by unterminated quotation mark in schema lexer lex() function, letting attackers cause application crash and denial of service, exploit requires crafted schema input.
- 7.5 /10 HighCVE-2026-88344 No auth
flatcc - Out-of-Bounds Read
flatcc 4c3b999e contains an out-of-bounds read caused by an integer digit-scan loop in schema lexer lex() advancing past buffer end when schema ends with a digit, letting attackers cause denial of service via crash, exploit requires crafted schema input.
- 7.6 /10 HighCVE-2026-88340 No auth
YARA - Insecure Deserialization
YARA 4.5.8 contains an insecure deserialization vulnerability caused by insufficient validation of external-variable pointers during deserialization of compiled .yrc rule files, letting attackers cause memory corruption and application crash, exploit requires crafted .yrc file.
- 8.1 /10 CriticalCVE-2026-87902 CISA KEVPoC publicNo auth
Unknown Product - Remote Code Execution
An unauthenticated attacker can exploit a file inclusion vulnerability in get_page_template() causing inclusion of arbitrary readable local .php files outside active theme directories, potentially leading to remote code execution if server and theme conditions are met.
- 9.8 /10 CriticalCVE-2026-87121 No auth
lwIP TCP/IP Stack - Remote Code Execution
lwIP TCP/IP Stack MQTT contains an out-of-bounds write vulnerability in the MQTT component, letting attackers gain full code execution on the device, exploit requires network access.
- 7.5 /10 HighCVE-2026-87082 No auth
Net::IDN::Punycode - Denial of Service & Data Tampering
Net::IDN::Punycode before 2.590 for Perl contains an encoding flaw caused by unvalidated malformed UTF-8 input in encode_punycode, letting attackers cause hangs, crashes, or incorrect labels, exploit requires direct call to encode_punycode with crafted input.
- 7.5 /10 HighCVE-2026-87081 No auth
Net::IDN::UTS46 - Denial of Service
Net::IDN::UTS46 < 2.590 for Perl contains a denial of service caused by quadratic punycode encoding of an overlong label before length check in to_ascii, letting attackers exhaust CPU resources, exploit requires sending crafted input with many distinct non-ASCII characters.
- 9.1 /10 CriticalCVE-2026-87080 No auth
Net::IDN::Punycode - Logic Error
Net::IDN::Punycode::PP before 2.590 for Perl contains a logic error in decode_punycode caused by improper handling of truncated labels in the pure-Perl decoder, letting attackers cause inconsistent name resolution, exploit requires crafted punycode labels.
- 7.5 /10 HighCVE-2026-87079 No auth
Net::IDN::Punycode - Denial of Service
Net::IDN::Punycode < 2.590 for Perl contains a CPU exhaustion vulnerability caused by quadratic insertion cost in decode_punycode when decoding long labels, letting attackers cause denial of service, exploit requires attacker to supply long labels.
- 9.1 /10 CriticalCVE-2026-87078 No auth
Net::IDN::Punycode - Denial of Service
Net::IDN::Punycode versions >= 2.302 and < 2.590 for Perl contain a memory leak caused by improper buffer release in decode_punycode XS backend, letting attackers cause memory exhaustion by sending invalid labels, exploit requires attacker to supply invalid labels.
- 9.6 /10 CriticalCVE-2026-86059 Auth required
Dokploy - Broken Access Control
Dokploy < 0.29.13 contains an information disclosure caused by missing access control checks in provider and application routes, letting organization members without Git provider access retrieve plaintext credentials, exploit requires application read access or provider identifier.
- 7.8 /10 HighCVE-2026-86054 No auth
Notepad++ - Buffer Overflow
Notepad++ < 8.9.8 contains a stack buffer overflow caused by unbounded wcscpy and wcscat operations in NppParameters::writeSession, letting attackers cause denial of service by triggering stack canary termination, exploit requires a long settings directory path.