Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 450 of 695
- 8.1 /10 HighCVE-2026-6205 Auth required
Synology DiskStation Manager - Unrestricted File Upload
Synology DiskStation Manager (DSM) < 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 contains an unrestricted file write vulnerability caused by external control of file name or path in Upload API, letting remote authenticated users write arbitrary files and cause denial of service.
- 8.1 /10 HighCVE-2026-61833 Auth required
Zot - Broken Access Control
Zot < 2.1.18 contains a broken access control vulnerability caused by improper permission checks on DELETE requests in bearer authentication handler, letting remote attackers with push permissions delete manifests and blobs, exploit requires bearer token with push and pull permissions.
- 8.5 /10 HighCVE-2026-61821 Auth required
pg_partman - Broken Access Control
pg_partman prior to 5.5.0 contains a broken access control vulnerability caused by improper schema privilege checks in drop_partition_id() and drop_partition_time(), letting roles with partman_user access relocate child tables between schemas without proper authorization, exploit requires partman_user role access.
- 8.5 /10 HighCVE-2026-61820 Auth required
pg_partman - Command Injection
pg_partman < 5.5.0 contains a command injection caused by improper escaping of double quotes in primary-key column names in inherit_template_properties(), letting a partman_user with template table ownership execute OS commands with superuser privileges, exploit requires crafted column names.
- 8.5 /10 HighCVE-2026-61819 Auth required
pg_partman - SQL Injection
pg_partman < 5.5.0 contains a SQL injection caused by improper handling of p_parent_table in exception handlers calling pg_jobmon.add_job(), letting partman_user execute SQL with superuser privileges, exploit requires crafted parent-table name with single quote.
- 8.5 /10 HighCVE-2026-61818 Auth required
pg_partman - Command Injection
pg_partman < 5.5.0 contains a command injection caused by unquoted interpolation of part_config.time_encoder in undo_partition(), letting roles with partman_user access execute arbitrary SQL with caller privileges, exploit requires partman_user role.
- 8.5 /10 HighCVE-2026-61817 Auth required
pg_partman - Command Injection
pg_partman prior to 5.5.0 contains a command injection caused by unquoted interpolation of part_config.time_dncoder in dynamic SQL, letting roles with partman_user privileges execute arbitrary SQL with elevated privileges, exploit requires partman_user role.
- 9.9 /10 CriticalCVE-2026-61781 Auth required
pg_partman - Command Injection
pg_partman prior to 5.5.0 contains a command injection caused by unquoted interpolation of part_config.time_encoder in create_partition_time(), letting roles with partman_user INSERT/UPDATE privileges execute arbitrary SQL with superuser privileges, exploit requires partman_user role privileges.
- 8.0 /10 HighCVE-2026-61721 No auth
FluidSynth - Out of Bounds Read & Denial of Service
FluidSynth 2.5.0 to 2.5.6 contains an out-of-bounds read caused by improper validation of wsmp.loop_start and wsmp.loop_length in the native DLS loader, letting attackers cause memory disclosure and denial of service, exploit requires crafted DLS file.
- 7.8 /10 HighCVE-2026-61714 No auth
FluidSynth - Out of Bounds Read/Write
FluidSynth 2.2.4 to 2.5.6 contains an out-of-bounds read/write caused by configuring synth.midi-channels above 16 in _fluid_player_t::channel_isplaying, letting attackers cause undefined behavior affecting confidentiality, integrity, or availability, exploit requires setting midi-channels above 16.
- 9.9 /10 CriticalCVE-2026-61682 Auth required
kcp - Broken Access Control
kcp < 0.31.4 and < 0.32.2 contains a broken access control vulnerability caused by front-proxy not removing inbound identity headers, letting authenticated tenants impersonate identities and bypass authorization, exploit requires tenant authentication.
- 7.1 /10 HighCVE-2026-61672 Auth required
Capsule - Broken Access Control
Capsule < 0.13.7 contains a broken access control caused by case-insensitive sorting mismatch in ForbiddenListSpec.ExactMatch, letting authenticated tenant owners bypass metadata restrictions, exploit requires tenant authentication.
- 7.2 /10 HighCVE-2026-61552 Auth required
Icinga 2 - Broken Access Control
Icinga 2 2.4 to 2.14.9, 2.15.4, and 2.16.2 contains a broken access control caused by unescaped attacker-controlled template names in /v1/objects API, letting authenticated ApiUser inject DSL configuration and escalate privileges, exploit requires objects/create/* permission.
- 8.6 /10 HighCVE-2026-61551 No auth
Icinga 2 - Denial of Service
Icinga 2 < 2.14.9, < 2.15.4, and < 2.16.2 contain a denial of service caused by unbounded JSON nesting depth in the parser, letting remote unauthenticated attackers crash the process via TCP port 5665.
- 9.8 /10 CriticalCVE-2026-61550
Icinga 2 - Authentication Bypass
Icinga 2 2.8 to 2.14.9, 2.15.4, and 2.16.2 contains a broken authentication caused by lack of validation of sender in certificate update JSON-RPC message handling, letting unauthenticated network attackers impersonate trusted nodes and take control, exploit requires network access to TCP port 5665.