Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 454 of 695

  • 9.9 /10 Critical
    CVE-2025-53837 Auth required

    XWiki Rendering - Remote Code Execution

    XWiki Rendering < 14.10.2 and < 15.0 RC1 contains a remote code execution caused by unescaped rendering output in HTML macros, letting users with edit rights execute arbitrary script macros with programming rights, exploit requires edit access to user profile or documents.

  • 10.0 /10 Critical
    CVE-2025-15399 No auth

    IBM Common Licensing Agent - Cross-Site Request Forgery

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 contain a cross-site request forgery vulnerability caused by lack of proper request validation, letting attackers execute unauthorized actions via trusted user sessions, exploit requires victim user interaction.

  • 8.8 /10 High
    CVE-2025-14754 Auth required

    IBM Cloud Pak for Data - Command Injection

    IBM Cloud Pak for Data 5.1.2 contains a command injection caused by improper validation of user supplied input, letting authenticated users execute arbitrary commands with elevated privileges.

  • 7.5 /10 High
    CVE-2025-14753 No auth

    IBM Cloud Pak for Data - Path Traversal

    IBM Cloud Pak for Data 5.1.2 contains a path traversal caused by specially crafted URL requests with "dot dot" sequences (/../), letting remote attackers view arbitrary files on the system, exploit requires network access.

  • 7.5 /10 High
    CVE-2023-5778

    ABB Freelance Controller - Undefined Vulnerability

    ABB Freelance Controller DCP, AC700, AC800, and AC900 (through 2019 SP1) contain an improper handling of length parameter inconsistency vulnerability, letting attackers cause potential unexpected behavior, exploit requires unspecified conditions.

  • 9.8 /10 Critical
    CVE-2023-54399 CISA KEVNo auth

    Hongjing e-HR - SQL Injection

    Hongjing e-HR < 8.2 contains a SQL injection caused by unsanitized 'categories' parameter in /servlet/codesettree after HRMS-encoding is stripped, letting unauthenticated remote attackers read arbitrary database content.

  • 7.5 /10 High
    CVE-2021-48008 CISA KEVNo auth

    Chanjet CRM - SQL Injection

    Chanjet CRM contains an unauthenticated SQL injection caused by improper sanitization of the site_id GET parameter in the webservice endpoint, letting remote attackers execute arbitrary SQL queries and extract sensitive data, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2019-25776 CISA KEVNo auth

    Weaver E-cology - SQL Injection

    Weaver E-cology contains an unauthenticated SQL injection caused by improper sanitization of the userIdentifiers GET parameter in the mobile plugin endpoint, letting remote attackers execute arbitrary SQL queries and extract sensitive data.

  • 7.5 /10 High
    CVE-2017-20284 CISA KEVNo auth

    Caucho Resin - Path Traversal

    Caucho Resin contains a path traversal caused by directory traversal sequences in the inputFile request parameter of the jndi-appconfig tutorial servlet, letting remote unauthenticated attackers read arbitrary files.

  • 7.5 /10 High
    CVE-2026-93436 No auth

    vLLM - Denial of Service

    vLLM through 0.29.0 contains a denial of service caused by improper cleanup of decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments, letting remote attackers exhaust decode-worker memory, exploit requires sending requests with max_tokens=0.

  • 7.5 /10 High
    CVE-2026-93435 No auth

    redis-parser - Denial of Service

    redis-parser through 3.0.0 contains a denial of service caused by unbounded recursion on nested arrays in the RESP protocol parser, letting attackers crash the client process, exploit requires sending crafted RESP byte streams.

  • 8.5 /10 High
    CVE-2026-93426 Auth required

    SigNoz - SQL Injection

    SigNoz 0.87.0 before 0.142.0 contains a SQL injection caused by failure to escape user-supplied telemetry field-key names in the v5 query_range API, letting authenticated users with Viewer role or higher execute arbitrary ClickHouse SQL, exploit requires authenticated user with Viewer role or higher.

  • 8.1 /10 High
    CVE-2026-93393 No auth

    MongoDB C Driver - Buffer Overflow

    MongoDB C Driver contains a heap-based buffer overflow caused by improper bounds checking in the TLS transport layer on Windows platform TLS backend, letting remote attackers cause memory corruption or process termination, exploit requires no authentication or user interaction.

  • 8.8 /10 High
    CVE-2026-93382 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.52 contains a use after free vulnerability in PDFium, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-93381 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 153.0.8010.52 contains a buffer overflow caused by improper handling of crafted PDF files in PDFium, letting remote attackers execute arbitrary code inside the sandbox via social engineering.