Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 460 of 695
- 9.9 /10 CriticalCVE-2026-92939 Auth required
vm2 - Sandbox Escape & Remote Code Execution
vm2 3.11.3 through 3.11.6 contains a sandbox escape caused by exposure of the host Node.js crypto module via a recursive read-only proxy, letting sandboxed JavaScript execute arbitrary native code with host-process authority, exploit requires allowing the crypto builtin.
- 9.9 /10 CriticalCVE-2026-92938 Auth required
vm2 - Remote Code Execution
vm2 3.11.3 through 3.11.6 contains a native code execution vulnerability caused by improper handling of the node:sqlite module in NodeVM, letting sandboxed code execute arbitrary native code with host privileges, exploit requires builtin: ['*'] or explicit node:sqlite permission.
- 10.0 /10 CriticalCVE-2026-92937
vm2 - Remote Code Execution
vm2 3.11.6 contains a sandbox escape caused by improper sanitization of rejected host Promise values in lib/bridge.js, letting remote attackers execute arbitrary code in the host Node.js process, exploit requires exposure of a host-realm Promise to the sandbox.
- 9.0 /10 CriticalCVE-2026-92935 No auth
vm2 - Remote Code Execution
vm2 >= 3.11.4 and <= 3.11.6 contains a sandbox escape vulnerability caused by improper validation of the require option in NodeVM constructor, letting attackers execute arbitrary commands with host privileges by creating an inner NodeVM with elevated builtin allowlist, exploit requires attacker to supply crafted JavaScript with specific NodeVM configuration.
- 9.0 /10 CriticalCVE-2026-92934
vm2 - Sandbox Escape
vm2 < 3.11.8 contains a sandbox escape caused by incomplete Error.cause sanitization in handling revisited host-wrapped AggregateError objects, letting attackers execute remote code and disclose process information, exploit requires crafted exception handling.
- 7.3 /10 HighCVE-2026-92926 No auth
code-projects Matrimonial System - SQL Injection
code-projects Matrimonial System 1.0 contains a sql injection caused by manipulation of the "education" argument in /partner_preference.php writepartnerprefs function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.1 /10 HighCVE-2026-92925 No auth
Redis - Out-of-Bounds Read
Redis community cluster bus contains an out-of-bounds read vulnerability caused by improper null-termination validation of string-carrying extensions in PING/PONG/MEET packet parser, letting remote attackers cause information disclosure or denial of service, exploit requires crafted packet.
- 8.1 /10 HighCVE-2026-92919 Auth required
admin3 - Path Traversal
admin3 <= 3.0.0 contains a path traversal caused by failure to sanitize client-supplied filenames in the upload handler on Windows, letting authenticated users write files outside storage root, exploit requires authentication.
- 8.8 /10 HighCVE-2026-92918 Auth required
admin3 - Broken Access Control
admin3 <= 3.0.0 contains an information disclosure caused by persisting user session tokens in audit log event bodies, letting attackers with log:view permission harvest session tokens and gain full user access, exploit requires log:view permission.
- 7.5 /10 HighCVE-2026-92917 No auth
Grav - Information Disclosure
Grav 2.0.0-rc.1 through 2.0.21 contains an information disclosure vulnerability caused by improper sandbox filtering in Twig content sandbox, letting authenticated users with page-edit rights dump sensitive configuration data, exploit requires page-edit rights.
- 7.5 /10 HighCVE-2026-92916 No auth
Grav - Information Disclosure
Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21 contain an information disclosure vulnerability caused by unauthenticated access to the Clockwork profiler endpoint when debugger is enabled, letting remote attackers access sensitive session cookies, credentials, and configuration data, exploit requires debugger enabled with exposed /__clockwork/ endpoint.
- 7.3 /10 HighCVE-2026-92915 No auth
WWBN AVideo - Broken Access Control
WWBN AVideo contains a broken access control vulnerability in objects/userVerifyEmail.php caused by lack of login, CSRF protection, and rate limiting, letting unauthenticated attackers send unlimited verification emails and reset passwords, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-92914 Auth required
AVideo LoginControl - Authentication Bypass
AVideo LoginControl contains an authentication bypass caused by loose equality comparison against an uninitialized session variable in PGP second factor verification, letting attackers with victim's password bypass second factor by sending parameter-less GET request.
- 7.4 /10 HighCVE-2026-92913 No auth
AVideo - Authentication Bypass
AVideo contains a broken authentication caused by use of a weak pseudo-random number generator in account activation and login pairing codes, letting unauthenticated remote attackers guess valid codes to take over accounts, exploit requires unauthenticated access to login_code API.
- 8.2 /10 HighCVE-2026-92903 Auth required
Snowflake CLI - Command Injection
Snowflake CLI < 3.27.0 contains a command injection caused by unsanitized user-controlled input interpolated into SQL multi-statement queries, letting attackers execute arbitrary SQL in victim's Snowflake session, exploit requires write or pull-request access to project repository or supply untrusted input to CLI automation.