Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 431 of 695
- 7.5 /10 HighCVE-2026-73553 PoC publicNo auth
Envoy - Authorization Bypass
Envoy < 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contains a broken access control caused by inconsistent path canonicalization between router and RBAC url_path matcher, letting unauthenticated clients bypass path-based authorization, exploit requires route option and path-based RBAC rule both present.
- 7.5 /10 HighCVE-2026-73552 PoC publicNo auth
Envoy - Authorization Bypass
Envoy < 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contains an authorization bypass caused by improper handling of opaque header bytes in HTTP RBAC safe_regex evaluation, letting downstream clients bypass RBAC policies, exploit requires crafted opaque header bytes.
- 7.5 /10 HighCVE-2026-73550 PoC publicNo auth
Envoy - Denial of Service
Envoy < 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contains a denial of service caused by improper handling of HTTP/2 Host header values and HPACK indexing, letting unauthenticated clients exhaust memory, exploit requires HTTP/2 HPACK and duplicate Host discard behavior.
- 7.5 /10 HighCVE-2026-73548 PoC public
Envoy - HTTP Request Smuggling
Envoy < 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contains an HTTP request smuggling caused by improper handling of non-WebSocket HTTP upgrades, letting unauthenticated HTTP/2 clients smuggle requests and receive responses intended for others, exploit requires specific upgrade configurations.
- 7.5 /10 HighCVE-2026-73547 PoC publicNo auth
Envoy - Denial of Service
Envoy < 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contains a denial of service caused by dereferencing a null pointer in ext_authz filter when handling path-less CONNECT requests with query-parameter mutation, letting unauthenticated downstream clients crash the process, exploit requires accepting path-less CONNECT and ext_authz query-parameter mutation.
- 7.4 /10 HighCVE-2026-73546 PoC publicNo auth
Envoy - Stored XSS
Envoy < 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contains a stored XSS caused by unencoded statistic names in /stats?format=html admin endpoint, letting attackers execute scripts in admin interface, exploit requires browser-accessible admin interface and enabled component persisting attacker data.
- 7.5 /10 HighCVE-2026-73513 PoC public
Envoy - Denial of Service
Envoy < 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contains a denial of service caused by oghttp2 codec accepting response trailer HEADERS frame without END_STREAM, letting attackers crash the process, exploit requires oghttp2 codec enabled upstream.
- 7.5 /10 HighCVE-2026-73512 PoC publicNo auth
Envoy - Denial of Service
Envoy < 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contains a denial of service caused by use-after-free of cached RequestDecoder in HttpDatagramHandler with Capsule Protocol enabled, letting attackers crash the process via HTTP/3 datagrams during stream recreation.
- 9.8 /10 CriticalCVE-2026-67827 No auth
ZLMediaKit - Broken Access Control
ZLMediaKit contains an incorrect access control vulnerability caused by unauthenticated access to the setServerConfig API endpoint, letting remote attackers achieve remote code execution by overwriting ffmpeg.snap with shell commands, exploit requires no authentication.
- 7.7 /10 HighCVE-2026-63330 Auth required
Warpgate - Broken Access Control
Warpgate < 0.25.6 contains an information disclosure vulnerability caused by missing admin permission checks in api_get_recording_stream, letting authenticated users access real-time session recordings, exploit requires user authentication.
- 8.8 /10 HighCVE-2026-63116 Auth required
Deepstream - Broken Access Control
Deepstream 10.1.0 to 10.1.1 contains a broken access control caused by omission of RECORD_ACTION.PATCH_MULTI in RULES_MAP, letting authenticated users modify arbitrary protected records, exploit requires authenticated user.
- 8.8 /10 HighCVE-2026-62371 Auth required
KubeEdge - Command Injection
KubeEdge v1alpha2 NodeUpgradeJob handler in versions 1.12.0 to 1.21.2, 1.22.2, and 1.23.1 contains a command injection caused by concatenation of authenticated user-controlled spec.version and spec.image into shell commands, letting users with NodeUpgradeJob create/update permissions execute arbitrary commands on edge nodes, exploit requires permission to create or update NodeUpgradeJob resources.
- 8.1 /10 HighCVE-2026-62369
KubeEdge - Path Traversal
KubeEdge 1.16.0 to <1.21.2, 1.22.2, 1.23.1 contains a path traversal caused by insufficient validation in DecompressTarGz function during keadm join or installation on Windows edge nodes, letting attackers write or overwrite files with keadm privileges, exploit requires compromised or untrusted archive source.
- 8.8 /10 HighCVE-2026-62182 Auth required
KubeEdge - Command Injection
KubeEdge 1.21.0 to 1.21.2, 1.22.2, and 1.23.1 contains a command injection caused by concatenation of user-controlled updateFields into keadm config-update command executed via system shell, letting authenticated users execute arbitrary commands with KubeEdge process privileges, exploit requires permission to create or modify ConfigUpdateJob resources.
- 7.1 /10 HighCVE-2026-61687 No auth
Hatchet - Authentication Bypass
Hatchet < 0.91.1 contains an authentication bypass caused by improper clearing of oauth_state_ session value in ValidateOAuthState, letting unauthenticated attackers bind victim sessions to attacker-controlled OAuth identities, exploit requires victim to complete OAuth flow and specific auth integrations enabled.