Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 439 of 695

  • 7.5 /10 High
    CVE-2026-93748 No auth

    http-cache-semantics - Information Disclosure

    http-cache-semantics <= 4.2.0 contains an information disclosure vulnerability caused by improper validation of security-zeroed cache entries when processing client max-stale directives, letting unauthenticated attackers retrieve cached responses of other users, exploit requires attacker to send requests with large max-stale values.

  • 10.0 /10 Critical
    CVE-2026-93740 No auth

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formWlEncrypt, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-93739 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formWlAc, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-93738 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "webpage" argument in /boafrm/formSchedule, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-93690 No auth

    uri-js - Denial of Service

    uri-js <= 4.4.1 contains a denial of service caused by an infinite loop in removeDotSegments function when path segments start with Unicode line or paragraph separators, letting attackers block the Node.js event loop indefinitely, exploit requires calling removeDotSegments or related functions with IRI enabled.

  • 7.5 /10 High
    CVE-2026-93688 No auth

    SGLang - Denial of Service

    SGLang through 0.5.19 contains a denial of service caused by failure to validate bootstrap_room values in prefill/decode disaggregation mode with Mooncake KV transfer backend, letting unauthenticated attackers exhaust memory via POST /generate endpoint.

  • 7.5 /10 High
    CVE-2026-93687 PoC publicNo auth

    Braces - Denial of Service

    Braces <= 3.0.3 contains a stack overflow caused by recursive AST walkers lacking depth guards, letting attackers exhaust the call stack and terminate the Node.js process, exploit requires supplying deeply nested brace patterns.

  • 8.1 /10 High
    CVE-2026-93659 PoC publicNo auth

    Concrete CMS Community Store - Stored XSS

    Concrete CMS Community Store < 2.7.8 contains a stored XSS caused by lack of HTML escaping in customer-supplied order fields, letting unauthenticated attackers execute scripts in authenticated manager sessions, exploit requires no authentication.

  • 7.0 /10 High
    CVE-2026-93658 Auth required

    uutils coreutils - Privilege Escalation

    uutils coreutils < 0.10.0 contains a privilege escalation vulnerability caused by applying setuid or setgid mode before finalizing ownership changes, letting privileged users execute leftover setuid executables with elevated privileges when ownership changes fail.

  • 7.5 /10 High
    CVE-2026-93657 No auth

    hickory-resolver - Authentication Bypass

    hickory-resolver < 0.26.2 contains a DNSSEC authentication bypass caused by failure to propagate bogus DNSSEC proof states in Resolver::lookup() and Resolver::lookup_ip() APIs, letting attackers with control over DNS or network path bypass DNSSEC validation.

  • 7.5 /10 High
    CVE-2026-93652 No auth

    µD3TN - Integer Overflow

    µD3TN v0.15.0 contains an integer overflow caused by improper handling in TCPCLv3 handshake, letting remote attackers cause a heap overflow leading to denial of service, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-93606

    vm2 - Sandbox Escape

    vm2 (npm) <= 3.12.0 contains a sandbox escape caused by improper host Promise rejection sanitization in VM and NodeVM, letting sandboxed code execute arbitrary code on the host, exploit requires exposed host API returning host-realm Promise.

  • 10.0 /10 Critical
    CVE-2026-93605 No auth

    vm2 NodeVM - Remote Code Execution

    vm2 NodeVM < 3.12.1 contains a sandbox escape vulnerability caused by omission of child_process from DANGEROUS_BUILTINS denylist, letting attackers execute arbitrary commands on the host when configured with builtin:['*'] or explicit child_process allowance.

  • 7.2 /10 High
    CVE-2026-93604 No auth

    vm2 - Privilege Escalation

    vm2 <= 3.12.0 contains a privilege escalation caused by exposing crypto.setFips() to untrusted guest code in NodeVM when 'crypto' builtin is allowlisted, letting guest code change host process FIPS mode, exploit requires embedding with 'crypto' builtin allowlisted.

  • 10.0 /10 Critical
    CVE-2026-93603 No auth

    vm2 - Sandbox Escape

    vm2 <= 3.12.0 contains a sandbox escape caused by improper handling of nullish `this` receiver in the apply trap of its bridge, letting sandboxed code execute arbitrary commands on the host, exploit requires exposure of non-strict host functions.