Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 440 of 695
- 7.5 /10 HighCVE-2026-93599
rustls-webpki - Denial of Service
rustls-webpki <= 0.103.12 and 0.104.0-alpha < 0.104.0-alpha.7 contain a denial of service caused by an underflow panic in bit_string_flags() when parsing a crafted CRL with an issuingDistributionPoint extension, letting attackers cause a panic via crafted CRL input, exploit requires explicit CRL revocation checking enabled and attacker-controlled CRL bytes.
- 7.7 /10 HighCVE-2026-93597 Auth required
ArcadeDB - Server Side Request Forgery
ArcadeDB < 26.9.1 contains a server-side request forgery caused by improper validation of IPv6 transition addresses in SSRF guard for IMPORT DATABASE and server commands, letting authenticated attackers reach internal services and cloud metadata endpoints.
- 8.1 /10 HighCVE-2026-93594 Auth required
ArcadeDB - Broken Access Control
ArcadeDB <= 26.8.1 contains a broken access control vulnerability caused by missing permission checks in LSM index and TimeSeries engine query paths, letting authenticated users read and delete index entries bypassing type-level restrictions, exploit requires authenticated user.
- 8.1 /10 HighCVE-2026-93593 Auth required
ArcadeDB - Broken Access Control
ArcadeDB < 26.9.1 contains a broken access control caused by missing type-name-based access checks for TimeSeries types, letting authenticated low-privilege users read or insert TimeSeries samples despite deny rules, exploit requires authentication.
- 7.5 /10 HighCVE-2026-93592 PoC publicNo auth
vLLM - Denial of Service
vLLM < 0.28.0 contains a denial of service caused by lack of validation of lower bound token IDs in /v1/embeddings and /pooling endpoints, letting unauthenticated attackers crash the engine by submitting negative token IDs.
- 7.6 /10 HighCVE-2026-93591 Auth required
SiYuan - SQL Injection
SiYuan < 3.8.3 contains an sql injection caused by unescaped tag values concatenated in graph.go query2Stmt function, letting publish-mode readers or anonymous visitors execute arbitrary SQL queries, exploit requires crafted inline HTML span tags.
- 7.5 /10 HighCVE-2026-93576 No auth
Netty netty-codec-smtp - Input Validation Bypass
Netty netty-codec-smtp contains an incomplete CRLF validation fix in the SMTP command-name field, letting attackers potentially bypass input validation, exploit requires crafted SMTP commands.
- 7.5 /10 HighCVE-2026-93575 No auth
Netty - Denial of Service
Netty contains a denial of service vulnerability caused by improper validation of MQTT Properties Length against Remaining Length in MqttDecoder, letting unauthenticated remote attackers exhaust memory and CPU by sending crafted packets, exploit requires network access.
- 7.5 /10 HighCVE-2026-93572 No auth
RedisArrayAggregator - Denial of Service
RedisArrayAggregator contains a resource exhaustion vulnerability caused by eager allocation of large nested RESP array headers, letting attackers exhaust memory by sending deeply nested large arrays, exploit requires sending crafted nested RESP arrays.
- 8.2 /10 HighCVE-2026-93569
CVE-2026-93569
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
- 7.5 /10 HighCVE-2026-93568
CVE-2026-93568
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
- 7.5 /10 HighCVE-2026-93567 No auth
HTTP Protocol - HTTP Request Smuggling
An HTTP/1 CONNECT request with authority-form is translated to a malformed HTTP/2 CONNECT request with a Host-controlled :authority header, allowing attackers to manipulate request routing or cause unexpected behavior.
- 7.5 /10 HighCVE-2026-93565 No auth
Netty RtspMethods - Authentication Bypass
Netty RtspMethods contains a broken authentication caused by RtspMethods.valueOf() silently stripping trailing control bytes before cache lookup, letting remote attackers send malformed RTSP methods that are accepted as valid, exploit requires sending RTSP requests with trailing control bytes.
- 7.5 /10 HighCVE-2026-93564 No auth
HAProxy - Resource Leak
HAProxy contains a PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak caused by incomplete fix of PR #16881, letting attackers cause resource leaks, exploit requires crafted PROXY-v2 nested-TLV packets.
- 7.5 /10 HighCVE-2026-93563 No auth
Unspecified Product - Denial of Service
An unspecified vendor's product contains a denial of service caused by unbounded multi-line response accumulation in SmtpResponseDecoder, letting attackers exhaust memory remotely, exploit requires crafted SMTP responses.