Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 441 of 695
- 7.5 /10 HighCVE-2026-93560 No auth
STOMP Codec - Denial of Service
STOMP codec contains an infinite decode loop denial of service caused by content-length long-to-int truncation, letting attackers cause service disruption, exploit requires crafted STOMP messages.
- 7.3 /10 HighCVE-2026-93559 No auth
Forget-C Jellyfish AI Short Drama Studio - Authentication Bypass
Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha to 0.3.2 contains a broken authentication caused by manipulation in backend/app/dependencies.py FastAPI component, letting remote attackers bypass authentication, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-93558 No auth
WebSocketServerExtensionHandler - Denial of Service
WebSocketServerExtensionHandler contains a denial of service caused by unbounded per-connection queue growth, letting attackers exhaust resources and cause service disruption, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-93494 No auth
Netty - Denial of Service
Netty StompSubframeDecoder contains a denial of service caused by missing terminating null byte in STOMP frame body leading to unreleased ByteBuf memory leak, letting remote attackers cause application DoS, exploit requires crafted STOMP frame.
- 7.5 /10 HighCVE-2026-93491 No auth
Netty HttpServerCodec - Denial of Service
Netty HttpServerCodec contains a denial of service caused by unbounded heap memory consumption from pipelined HTTP/1.1 requests with withheld reads, letting remote unauthenticated attackers exhaust memory, exploit requires HTTP/1.1 pipelining.
- 7.5 /10 HighCVE-2026-93488 No auth
Netty - Denial of Service
Netty contains a denial of service vulnerability caused by SpdySessionHandler accepting unlimited concurrent remote-initiated streams due to localConcurrentStreams defaulting to Integer.MAX_VALUE, letting remote attackers cause JVM OutOfMemoryError, exploit requires network access.
- 7.1 /10 HighCVE-2026-93485 PoC publicNo auth
Automattic WordPress - Stored XSS
Automattic WordPress core < 7.1.1, 7.0 < 7.0.5, 6.9 < 6.9.8, 6.8 < 6.8.9, 6.7 < 6.7.8, 6.6 < 6.6.8, 6.5 < 6.5.11, 6.4 < 6.4.11, 6.3 < 6.3.11, 6.2 < 6.2.12, 6.1 < 6.1.13, 6.0 < 6.0.15, 5.9 < 5.9.17, 5.8 < 5.8.16, 5.7 < 5.7.18, 5.6 < 5.6.20, 5.5 < 5.5.21, 5.4 < 5.4.22, 5.3 < 5.3.24, 5.2 < 5.2.27, 5.1 < 5.1.25, 5.0 < 5.0.28, 4.9 < 4.9.32, 4.8 < 4.8.31, and 4.7 < 4.7.36 contain a DOM-based stored cross-site scripting caused by improper input neutralization during web page generation, letting unauthenticated attackers execute scripts via comment moderation bypass, exploit requires comment moderation disabled and bypass of comment approval.
- 7.5 /10 HighCVE-2026-93468 No auth
HGiga OAKlouds - Arbitrary File Read
HGiga OAKlouds contains an arbitrary file read caused by relative path traversal, letting unauthenticated remote attackers read arbitrary system files, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-93467 No auth
HGiga OAKlouds - Insecure Deserialization
HGiga OAKlouds contains an insecure deserialization vulnerability caused by processing maliciously crafted serialized content, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-93456 No auth
django-page-cms - Stored XSS
django-page-cms through 2.0.13 contains a stored cross-site scripting caused by exempting five admin mutation views from CSRF protection in pages/admin/views.py, letting signed-in editors store unescaped content that affects all visitors, exploit requires editor login.
- 8.3 /10 HighCVE-2026-93453 PoC publicNo auth
SOGo - Open Redirect
SOGo < 5.12.11 contains an open redirect caused by using client-supplied Origin header in password-reset links, letting unauthenticated attackers redirect recovery tokens to attacker domains, exploit requires crafted Origin header.
- 7.5 /10 HighCVE-2026-93452 No auth
snappy-java - Buffer Overflow
snappy-java through 1.1.10.8 contains a buffer overflow caused by writing past the end of the destination buffer in Snappy.compress(ByteBuffer, ByteBuffer), letting attackers corrupt off-heap memory and cause JVM termination, exploit requires supplying incompressible data exceeding buffer capacity.
- 7.5 /10 HighCVE-2026-93450 No auth
go-openapi/swag - Denial of Service
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability caused by unbounded recursion in ordered JSON parsing and serialization, letting remote unauthenticated attackers cause denial of service by submitting deeply nested JSON documents.
- 8.3 /10 HighCVE-2026-93371 No auth
marcopiovanello yt-dlp-web-ui - Command Injection
marcopiovanello yt-dlp-web-ui <= v4 contains a command injection caused by manipulation of the "params" argument in NewGenericDownload function, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-93331 No auth
GPAC - Out of Bounds Read
GPAC 26.08-DEV contains an out-of-bounds read caused by improper handling of the "size" argument in gf_rtp_parse_ttxt function of RTP Depacketizer, letting remote attackers read memory out-of-bounds, exploit requires crafted input.