Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 427 of 695

  • 8.2 /10 High
    CVE-2026-94488 No auth

    Telegram Desktop - Stored XSS

    Telegram Desktop < 6.9.4 contains a stored XSS caused by improper sanitization in HTML exporter component button.text.toUtf8, letting attackers execute scripts via exported HTML, exploit requires victim to use HTML export.

  • 7.5 /10 High
    CVE-2026-94449 No auth

    SmallRye Fault Tolerance - Denial of Service

    SmallRye Fault Tolerance library used by Quarkus contains a memory leak caused by failure to release internal tracking objects after each request when using ApplyGuard or ApplyFaultTolerance annotations, letting attackers cause denial of service by exhausting memory, exploit requires usage of these annotations.

  • 8.8 /10 High
    CVE-2026-94425 Auth required

    Moore Threads MTT S80 Driver Package - Broken Access Control

    Moore Threads MTT S80 Driver Package 340.150 contains a broken access control caused by improper privilege management in IOCTL Handler function sub_140006F0C, letting local attackers escalate privileges, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-94424 Auth required

    Moore Threads MTT S80 Driver Package - Buffer Overflow

    Moore Threads MTT S80 Driver Package <= 340.150 contains a heap-based buffer overflow caused by improper handling in IOCTL Handler function sub_140001000, letting local attackers cause memory corruption, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-94412 Auth required

    jshERP - Authorization Bypass

    jshERP through 3.6 contains an authorization bypass caused by improper access control in the POST /user/resetPwd endpoint, letting authenticated users reset any other user's password, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-94411 Auth required

    jshERP - Privilege Escalation

    jshERP 3.6 contains a privilege escalation vulnerability caused by improper authorization in the updateOneValueByKeyIdAndType endpoint, letting authenticated users escalate privileges by assigning arbitrary roles.

  • 8.8 /10 High
    CVE-2026-94403 Auth required

    ColorFul iGameCenter - Use After Free

    ColorFul iGameCenter 1.0.3.4 contains an untrusted pointer dereference caused by manipulation in the IOCTL Handler component, letting local attackers cause potential memory corruption, exploit requires local access.

  • 7.1 /10 High
    CVE-2026-94368 Auth required

    NooBaa noobaa-core - Broken Access Control

    NooBaa noobaa-core contains a broken access control vulnerability caused by improper validation of unsigned x-amz- headers in S3 presigned URLs using Signature Version 4, letting attackers with valid presigned PUT URLs perform unauthorized CopyObject operations, exploit requires possession of a valid presigned PUT URL.

  • 9.8 /10 Critical
    CVE-2026-94301 No auth

    Apache MINA - Broken Access Control

    Apache MINA 2.0.29, 2.1.13, and later 2.0.x and 2.1.x versions contain an acceptMatchers filter bypass caused by missing resolveProxyClass() override, letting attackers bypass allow-list filters, exploit requires crafted proxy classes.

  • 8.8 /10 High
    CVE-2026-94146 Auth required

    BioStar BIOS Update Utility - Write-What-Where Condition

    BioStar BIOS Update Utility 1.9.7.3 contains a write-what-where condition caused by manipulation of PhysicalAddress/Size argument in IOCTL Handler sub_110BC, letting local attackers write arbitrary memory, exploit requires local access.

  • 7.3 /10 High
    CVE-2026-94144 No auth

    drogonframework drogon - SQL Injection

    drogonframework drogon <= 1.9.13 contains a sql injection caused by manipulation of the "filter" argument in ORM component's makeCriteria function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-94143 No auth

    drogonframework drogon - SQL Injection

    drogonframework drogon <= 1.9.13 contains a SQL injection caused by manipulation of the "sort" argument in Mapper::orderBy function of ORM Mapper, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-94142 Auth required

    BioStar Temperature Monitor Utility - Arbitrary Memory Write

    BioStar Temperature Monitor Utility 1.2.1806.2200 contains a write-what-where condition caused by manipulation of the PhysicalAddress argument in IOCTL Handler sub_1105C, letting local attackers write arbitrary memory.

  • 7.4 /10 High
    CVE-2026-94139 Auth required

    Chengdu Feiyuxing Technology Feiyu Star Router - Command Injection

    Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656 contains a command injection caused by manipulation of the "session_id" argument in /send_order.cgi, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-94129 PoC publicAuth required

    BioStar VALKYRIE AURORA - Write-What-Where Condition

    BioStar VALKYRIE AURORA 2.10.2411.0800 contains a write-what-where condition caused by manipulation of the PhysicalAddress argument in IOCTL Handler sub_1105C, letting local attackers write arbitrary memory.