Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 429 of 695

  • 7.1 /10 High
    CVE-2026-90860

    Canva Mobile App - Broken Access Control

    Canva Mobile App for HarmonyOS < 1.15.1 contains a broken access control vulnerability caused by unrestricted headers returned to external origins in privileged WebView, letting attackers access user sessions, exploit requires control of the WebView.

  • 7.5 /10 High
    CVE-2026-88806

    libX11 - Buffer Overflow

    libX11 < 1.8.14 contains a buffer overflow caused by improper handling of XkbGetMap overflowing the key_sym_map, letting a malicious X server execute arbitrary code, exploit requires a malicious X server.

  • 7.1 /10 High
    CVE-2026-88746 No auth

    idccms - Stored XSS

    idccms V1.70 contains a stored XSS caused by improper input sanitization in /admin/makeDiy_deal.php, letting attackers execute scripts in the context of other users, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-88738 Auth required

    Jazzware RT1000 Edge webUI - Unrestricted File Upload

    Jazzware RT1000 Edge webUI 20.0.1 contains an unrestricted file upload vulnerability caused by lack of validation in upgrade package upload functionality, letting authenticated attackers upload executable files leading to remote code execution.

  • 7.5 /10 High
    CVE-2026-88411 No auth

    FalkorDB Redis module - Denial of Service

    FalkorDB Redis module v4.20.1 contains a denial of service caused by improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c), letting attackers cause application crash, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-88410 Auth required

    FalkorDB Redis module - Misconfiguration

    FalkorDB Redis module v4.20.1 to v4.20.4 contains a misclassification of graph.UDF command caused by it not being registered as a write command, letting attackers cause unexpected application behavior, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-88409 Auth required

    FalkorDB Redis module - Buffer Overflow

    FalkorDB Redis module v4.20.1 to v4.20.4 contains a buffer overflow caused by improper handling in _Decode_GrB_Matrix function, letting attackers cause denial of service via crafted input, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-88407 No auth

    FalkorDB Redis module - Denial of Service

    FalkorDB Redis module 4.20.1 to 4.20.4 contains an out-of-bounds read caused by improper handling in node_token_count/relation_token_count, letting attackers cause denial of service via crafted input.

  • 7.5 /10 High
    CVE-2026-88406 No auth

    FalkorDB Redis module - Denial of Service

    FalkorDB Redis module v4.20.1 to v4.20.4 contains a stack overflow caused by improper validation in _ValidateUnion_Clauses function in /ast/ast_validations.c, letting attackers cause denial of service via crafted input.

  • 9.8 /10 Critical
    CVE-2026-88405 No auth

    Univer - Remote Code Execution

    Univer v1.0.0-alpha.2 contains a remote code execution caused by crafted payload in RemoteRegisterFunctionService function, letting remote attackers execute arbitrary code, exploit requires crafted payload.

  • 9.8 /10 Critical
    CVE-2026-88404 No auth

    Univer - Remote Code Execution

    Univer v1.0.0-alpha.2 contains a remote code execution caused by crafted payload in UniscriptExecutionService.execute() function, letting remote attackers execute arbitrary code, exploit requires crafted payload.

  • 9.8 /10 Critical
    CVE-2026-88402 No auth

    nocobase - SQL Injection

    nocobase v2.1.21 contains a sql injection caused by improper sanitization in the checkSQL function, letting attackers access sensitive database information via crafted SQL statements, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-86473 No auth

    Apache Airflow - Authentication Bypass

    Apache Airflow Core API contains a broken authentication caused by logout endpoint revoking only session tokens from cookies but not bearer tokens, letting attackers with stolen bearer tokens maintain access after victim logout, exploit requires attacker to already possess a valid token.

  • 9.8 /10 Critical
    CVE-2026-85751 No auth

    Mailu - Authentication Bypass

    Mailu 2.0 to 2024.06.55 and helm-charts prior to 2.7.3 contain an authentication bypass caused by trusting client-controlled X-Forwarded-By header when REAL_IP_HEADER is unset, letting unauthenticated remote attackers bypass proxy authentication, exploit requires PROXY_AUTH_WHITELIST configured and REAL_IP_HEADER unset.

  • 8.8 /10 High
    CVE-2026-84990 Auth required

    ntopng - Broken Access Control

    ntopng < 6.7.260718 contains a broken access control vulnerability caused by lack of administrator check in backup listing and download scripts, letting authenticated non-admin users download backups exposing sensitive credentials, exploit requires authentication.