Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 433 of 695
- 7.1 /10 HighCVE-2026-49450 No auth
Joplin Desktop - Remote Code Execution
Joplin Desktop for Windows < 3.7.2 contains a code execution vulnerability caused by omission of publisherName in package.json, letting attackers controlling update delivery run code with user privileges after user approval.
- 8.1 /10 HighCVE-2026-48976 Auth required
HomeBox - Broken Access Control
HomeBox < 0.26.0 contains a broken access control vulnerability caused by NotifierRepository.Update not verifying user ownership, letting authenticated users read or modify other tenants' notifier URLs including plaintext credentials, exploit requires authentication.
- 8.1 /10 HighCVE-2026-48975 Auth required
HomeBox - Broken Access Control
HomeBox < 0.26.0 contains a broken access control caused by missing verification of maintenance entry ownership in UpdateOneID and DeleteOneID methods, letting authenticated low-privileged users modify or delete other tenants' records, exploit requires authentication.
- 8.1 /10 HighCVE-2026-48826 Auth required
HomeBox - Broken Access Control
HomeBox < 0.26.0 contains a broken access control caused by improper authorization using global owner value instead of caller's role in active group, letting authenticated users delete complete inventory of other groups, exploit requires user membership in multiple groups.
- 7.5 /10 HighCVE-2026-47321 No auth
Apache MINA - Denial of Service
Apache MINA CompressionFilter contains a denial of service vulnerability caused by unbounded decompression size in ZLib inflate, letting attackers exhaust application memory, exploit requires sending specially crafted compressed data.
- 9.1 /10 CriticalCVE-2026-36469 No auth
CuteNews - Server-Side Request Forgery
CuteNews 2.1.2 contains a server-side request forgery caused by improper validation in core/modules/media.php upload_from_inet, letting attackers make arbitrary requests from the server, exploit requires access to the Upload by URL feature.
- 7.2 /10 HighCVE-2026-36467 Auth required
CuteNews - Unrestricted File Upload
CuteNews 2.1.2 contains an unrestricted file upload vulnerability in core/modules/media.php, letting remote authenticated users with Media Manager access execute arbitrary code, exploit requires authentication and Media Manager access.
- 7.8 /10 HighCVE-2026-17052 Auth required
Zephyr Time-aware GPIO - Write-What-Where
Zephyr Time-aware GPIO (CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y) contains a write-what-where vulnerability caused by missing K_SYSCALL_MEMORY_WRITE() checks in z_vrfy_tgpio_pin_read_ts_ec(), letting unprivileged users with device access write arbitrary kernel memory, exploit requires access to TGPIO device object.
- 8.0 /10 HighCVE-2026-15801 Auth required
CRI-O - Broken Access Control
CRI-O contains a broken access control vulnerability caused by insufficient validation of restore metadata in container checkpoint and restore feature, letting users with sufficient privileges perform unintended host filesystem operations, exploit requires container checkpoint and restore enabled and untrusted checkpoint content.
- 7.2 /10 HighCVE-2025-71421 Auth required
UVdesk core-framework - Broken Access Control
UVdesk core-framework < 1.1.7 contains a broken access control vulnerability in the editAgent endpoint, letting agents with agent-management privilege escalate their role to administrator, exploit requires agent-management privilege.
- 9.1 /10 CriticalCVE-2025-12999
Open VSX - Open Redirect & Cache Poisoning
Open VSX contains a cache poisoning vulnerability caused by unvalidated use of X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Prefix headers in URL construction, letting unauthenticated remote attackers inject malicious URLs into cached metadata, exploit requires a proxy that relays client headers without overwriting.
- 8.0 /10 HighCVE-2026-94109 Auth required
openEQUELLA - Remote Code Execution
openEQUELLA < 2026.1.0 contains a remote code execution caused by unsandboxed TemplateClassResolver in FreeMarker template compilation, letting authenticated attackers execute arbitrary commands via malicious template expressions.
- 8.1 /10 HighCVE-2026-94107 No auth
NivoCart - Authentication Bypass
NivoCart <= 2.4.0 contains a broken authentication caused by predictable password reset tokens generated using substr(md5(mt_rand()), 0, 10) in forgotten.php, letting attackers with knowledge of an admin email gain admin access without rate limiting or expiration.
- 8.8 /10 HighCVE-2026-94106 Auth required
getID3 - Command Injection
getID3 before 1.9.26 contains a command injection caused by unescaped filenames in shell-out handlers, letting attackers execute arbitrary OS commands with process privileges, exploit requires crafted malicious filenames.
- 8.8 /10 HighCVE-2026-94104 Auth required
NivoCart - Unrestricted File Upload
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability caused by insufficient validation of file extensions in the File Manager multi() endpoint, letting attackers with view-only back-office access upload and execute PHP files remotely, exploit requires view-only back-office access.