Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 432 of 695

  • 7.5 /10 High
    CVE-2026-61629 No auth

    nginx-ignition - Denial of Service

    nginx-ignition 2.29.0 through 2.40.0 contains a denial of service caused by unfiltered Accept-Language header parsing in gin i18n middleware, letting unauthenticated attackers cause high CPU usage, exploit requires crafted Accept-Language header.

  • 8.1 /10 High
    CVE-2026-61628 PoC publicNo auth

    nginx ignition - Broken Access Control

    nginx ignition < 2.41.1 contains a broken access control caused by a TOCTOU race condition in POST /api/users/onboarding/finish, letting remote unauthenticated attackers create admin accounts, exploit requires instance in pre-onboarding state.

  • 7.6 /10 High
    CVE-2026-59814 Auth required

    Joplin Server - Stored XSS

    Joplin Server < 3.7.7 contains a stored XSS caused by serving resources with attacker-controlled mime types and empty titles in GET /shares/:id?resource_id=, letting low-privileged users execute scripts in victim's browser, exploit requires publishing an empty-title SVG attachment.

  • 9.3 /10 Critical
    CVE-2026-58491 No auth

    Warpgate - Stored XSS & Open Redirect

    Warpgate < 0.25.5 contains a stored XSS and open redirect caused by unescaped attacker-controlled 'next' parameter in SSO endpoints, letting attackers execute scripts in authenticated sessions and redirect users, exploit requires victim interaction.

  • 8.1 /10 High
    CVE-2026-58269 Auth required

    Sync-in Server - Authentication Bypass

    Sync-in Server < 2.4.0 contains a 2FA bypass caused by missing 2FA enforcement in POST /api/auth/token, letting attackers with stolen credentials bypass two-factor authentication in a single request.

  • 8.8 /10 High
    CVE-2026-55897 Auth required

    luci-app-advanced-reboot - Command Injection

    luci-app-advanced-reboot < 1.1.2-6 contains a command injection caused by rpcd file.exec permission granted to /bin/sh in ACL, letting authenticated delegated sessions execute arbitrary commands as root, exploit requires authenticated delegated session.

  • 7.8 /10 High
    CVE-2026-55567 Auth required

    BleachBit - Broken Access Control

    BleachBit < 6.0.1 contains an arbitrary privileged file deletion vulnerability caused by lack of locking and validation of target's parent directory before deletion, letting local unprivileged users delete attacker-selected files, exploit requires local access.

  • 7.4 /10 High
    CVE-2026-55210 No auth

    Joplin Server - Authentication Bypass

    Joplin Server < 3.7.2 contains an authentication bypass caused by UserModel.ssoLogin() returning accounts without checking is_external flag, letting attackers with IdP session access local user accounts, exploit requires IdP session asserting local user's email.

  • 8.8 /10 High
    CVE-2026-55159 Auth required

    luci-app-adblock-fast - Command Injection

    luci-app-adblock-fast < 1.2.4-2 contains a command injection caused by improper handling of carriage-return or line-feed characters in the setCronEntry RPC method, letting authenticated delegated users with write ACL execute persistent commands as root, exploit requires write ACL.

  • 7.7 /10 High
    CVE-2026-55105 Auth required

    Joplin - Stored XSS

    Joplin < 3.6.15 and < 3.7.2 contains a stored XSS caused by unsanitized HTML output from fountain.js renderer in note output, letting attackers execute scripts via malicious Fountain code blocks, exploit requires Fountain rendering enabled.

  • 8.4 /10 High
    CVE-2026-55071 No auth

    MCP-for-Stata - Command Injection

    MCP-for-Stata < 1.19.0 contains a command injection caused by unsanitized user input concatenated into Stata command strings in ado_package_install tool, letting attackers execute arbitrary OS commands remotely, exploit requires ability to invoke the MCP tool or Python API.

  • 8.8 /10 High
    CVE-2026-53940 No auth

    Conda - Path Traversal & Remote Code Execution

    Conda < 26.5.2 contains a path traversal caused by unvalidated entry-point commands in noarch:python package metadata, letting attackers write files outside the installation prefix or overwrite entry points, exploit requires package installation.

  • 8.4 /10 High
    CVE-2026-49811 Auth required

    Dell Command | Monitor - Privilege Escalation

    Dell Command | Monitor (DCM) < 10.13.2 contains an incorrect permission assignment for critical resource, letting low privileged local attackers elevate their privileges, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-49810 Auth required

    Dell Command Powershell Provider - Information Disclosure

    Dell Command Powershell Provider (DCPP) < 2.10.2 contains an insertion of sensitive information into log file vulnerability caused by improper handling of sensitive data, letting low privileged local attackers disclose information, exploit requires local access.

  • 7.0 /10 High
    CVE-2026-49453 No auth

    Joplin - Path Traversal

    Joplin < 3.6.15 and < 3.7.2 contains a path traversal caused by unvalidated resource metadata in synchronized resources, letting attackers with write access to sync targets overwrite files at arbitrary paths without user interaction.