Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 458 of 695

  • 7.8 /10 High
    CVE-2026-93037

    Linux Kernel RDMA/hfi1 - Broken Authentication

    Linux kernel RDMA/hfi1 contains a broken authentication caused by set_txreq_header_ahg() ignoring sdma_txinit_ahg() errors, letting attackers cause improper request processing, exploit requires kernel-level access.

  • 7.1 /10 High
    CVE-2026-93014 Auth required

    RosarioSIS - Path Traversal

    RosarioSIS < 12.9 contains a path traversal caused by improper validation of filename parameter in Users and Students modules, letting authenticated users delete allow-listed files, exploit requires user authentication.

  • 7.5 /10 High
    CVE-2026-92987 No auth

    roxmltree - Denial of Service

    roxmltree through 0.21.1 contains a denial of service caused by quadratic-time attribute and namespace validation during XML parsing without limits on attribute count, letting attackers consume excessive CPU time, exploit requires crafted XML documents with many attributes.

  • 8.8 /10 High
    CVE-2026-92986 No auth

    SiYuan - Stored XSS

    SiYuan before 3.8.4 contains a stored XSS caused by unescaped HTML in document titles in the backlink dock tree, letting attackers execute scripts in the Electron renderer with command execution, exploit requires attacker to set malicious titles via rename API or crafted notebooks.

  • 8.8 /10 High
    CVE-2026-92985 No auth

    SiYuan - Stored XSS

    SiYuan < 3.8.4 contains a stored XSS caused by unescaped bookmark labels imported from notebook files in the dock tree, letting attackers execute scripts with child_process access for command execution, exploit requires crafted .sy notebook files.

  • 8.1 /10 High
    CVE-2026-92984 No auth

    HUBzero CMS - Authentication Bypass

    HUBzero CMS through 2.2.32 contains a session fixation vulnerability caused by acceptance of session identifiers from query strings and request variables instead of cookies alone, letting unauthenticated attackers hijack victim sessions by sending crafted links, exploit requires victim to authenticate after receiving crafted link.

  • 7.5 /10 High
    CVE-2026-92983 No auth

    InternLM LMDeploy - Denial of Service

    InternLM LMDeploy through 0.17.0 contains a denial of service caused by proxy using user-facing session IDs instead of internal scheduler keys in DistServe prefill/decode disaggregation mode, letting unauthenticated attackers exhaust memory, exploit requires sending completion requests to proxy endpoint.

  • 7.2 /10 High
    CVE-2026-92980 Auth required

    HortusFox-Web - Remote Code Execution

    HortusFox-Web < 6.1 contains a remote code execution caused by abuse of Import/Export functionality, letting authenticated administrators execute arbitrary OS commands as the web server user.

  • 8.6 /10 High
    CVE-2026-92972 No auth

    SGLang - Broken Access Control

    SGLang through 0.5.19 contains an insecure endpoint in prefill bootstrap service allowing unauthenticated attackers to poison KV transfer routing table by supplying arbitrary rank_ip and rank_port, causing denial of service or information disclosure.

  • 7.5 /10 High
    CVE-2026-92971 No auth

    InternLM LMDeploy - Denial of Service

    InternLM LMDeploy through 0.17.0 contains a denial of service caused by a reachable assertion in the DistServe decode migration loop, letting unauthenticated attackers crash the inference engine by submitting a crafted migration_request.

  • 8.8 /10 High
    CVE-2026-92970 Auth required

    HUBzero CMS - Path Traversal

    HUBzero CMS through 2.2.32 contains a path traversal caused by improper validation in project file upload handlers, letting authenticated project members write arbitrary files outside the project repository, potentially enabling code execution.

  • 7.5 /10 High
    CVE-2026-92961 No auth

    vm2 - Denial of Service

    vm2 before 3.11.6 contains a denial of service caused by failure to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, letting attackers exhaust host memory, exploit requires crafted input using V8 intrinsics.

  • 10.0 /10 Critical
    CVE-2026-92960 No auth

    vm2 - Sandbox Escape

    vm2 before 3.11.6 contains a sandbox escape caused by failure to restrict access to os and dns builtins under builtin: ['*'] configuration, letting attackers hijack host DNS resolver globally, exploit requires crafted sandbox code.

  • 7.1 /10 High
    CVE-2026-92959 Auth required

    vm2 - Asynchronous Execution Bypass

    vm2 before 3.11.8 contains an asynchronous execution bypass caused by incomplete enforcement of the allowAsync: false option in VM and NodeVM, letting sandboxed scripts execute code after VM.run() returns, exploit requires sandboxed code execution.

  • 8.5 /10 High
    CVE-2026-92958 Auth required

    vm2 - Sandbox Bypass

    vm2 <= 3.11.6 contains a builtin-module denylist bypass caused by improper matching of negative entries in NodeVM builtin module restrictions, letting sandboxed code access restricted fs/promises APIs, exploit requires crafted require configuration.