Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 422 of 695
- 8.8 /10 HighCVE-2026-65128 Auth required
NVIDIA Infrastructure Controller for Linux - SQL Injection
NVIDIA Infrastructure Controller for Linux contains a sql injection caused by unsanitized input in SQL queries, letting attackers execute code, tamper data, cause denial of service, and disclose information, exploit requires crafted input.
- 8.2 /10 HighCVE-2026-65121
NVIDIA Infrastructure Controller for Linux - Authentication Bypass
NVIDIA Infrastructure Controller for Linux contains an improper authentication vulnerability, letting attackers escalate privileges, disclose information, and tamper data, exploit requires unspecified conditions.
- 7.5 /10 HighCVE-2026-65118 No auth
NVIDIA Infrastructure Controller for Linux - Improper Certificate Validation
NVIDIA Infrastructure Controller for Linux contains an improper certificate validation vulnerability, letting attackers cause information disclosure, data tampering, and denial of service, exploit requires no special conditions.
- 8.3 /10 HighCVE-2026-65114 No auth
NVIDIA Infrastructure Controller for Linux - Authentication Bypass
NVIDIA Infrastructure Controller for Linux contains a broken authentication vulnerability caused by missing authentication for a critical function, letting attackers tamper data, cause denial of service, and disclose information, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-65113 No auth
NVIDIA Infrastructure Controller for Linux - Hardcoded Credentials
NVIDIA Infrastructure Controller for Linux contains a hardcoded credentials vulnerability caused by use of hard-coded credentials, letting attackers escalate privileges, tamper data, cause denial of service, and disclose information, exploit requires no special conditions.
- 7.8 /10 HighCVE-2026-65111 Auth required
NVIDIA NeMo Speech - Command Injection
NVIDIA NeMo Speech contains a command injection caused by malicious input processing, letting attackers execute code, disclose information, and tamper data, exploit requires crafted malicious input.
- 8.1 /10 HighCVE-2026-63104 Auth required
Kaneo - Broken Access Control
Kaneo 2.3.12 before 2.12.2 contains a broken access control vulnerability caused by missing role-based permission checks in the bulk task endpoint, letting authenticated workspace members with viewer or member roles delete or modify tasks beyond their permissions, exploit requires authenticated workspace membership.
- 7.5 /10 HighCVE-2026-62985 No auth
request-filtering-agent - Denial of Service
request-filtering-agent < 3.2.1 contains an uncaught exception vulnerability caused by synchronous throw in createConnection for private IP hosts, letting attackers cause application crash, exploit requires sending requests to private IPs.
- 7.5 /10 HighCVE-2026-61685 No auth
ReactPress - SQL Injection
ReactPress prior to 3.7.0 contains a SQL injection caused by unsanitized HTTP query parameter names used as SQL column identifiers in TypeORM QueryBuilder, letting unauthenticated attackers inject SQL, exploit requires crafted query string keys.
- 7.5 /10 HighCVE-2026-61570 No auth
MPXJ - XML External Entity Injection
MPXJ 5.5.5 to <16.4.1 contains an XML external entity injection caused by enabled doctype declarations and external entities in MerlinReader parsing ZTIMEINTERVALS column, letting attackers read arbitrary local files, exploit requires crafted database.
- 7.5 /10 HighCVE-2026-59991 No auth
psd-tools - Denial of Service
psd-tools prior to 1.17.4 contains a denial of service caused by unvalidated attacker-controlled PSD header geometry in PSDImage.composite() and PSDImage.numpy(), letting attackers cause excessive memory allocation and service termination, exploit requires processing crafted PSD files.
- 7.5 /10 HighCVE-2026-58268 No auth
SIPGO - Denial of Service
SIPGO < 1.4.1 contains a denial of service caused by client-controlled Content-Length header allocating excessive memory in ParserStream.parseSingle, letting unauthenticated peers cause resource exhaustion, exploit requires sending oversized message length.
- 9.9 /10 CriticalCVE-2026-57149 Auth required
Plone plone.app.portlets.portlets - Server-Side Template Injection
Plone plone.app.portlets.portlets 5.0.0 to <5.0.8, <6.0.4, and <7.0.2 contains a code execution vulnerability caused by unsafe evaluation of user-supplied TALES expressions in the Classic portlet template, letting authenticated users execute arbitrary code, exploit requires ability to add or edit Classic portlets.
- 7.3 /10 HighCVE-2026-56681 No auth
9Router - Authentication Bypass
9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation.
- 9.8 /10 CriticalCVE-2026-47116
LTSecurity LTK3500SF - Hardcoded Credentials
LTSecurity LTK3500SF contains a hardcoded credentials vulnerability caused by reversible hashed root and guest passwords in /etc/shadow, letting attackers authenticate via Telnet or SSH to gain root access, exploit requires access to hashed passwords.