Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 475 of 695
- 9.1 /10 CriticalCVE-2026-63472 No auth
Vendure - Broken Access Control
Vendure < 3.7.0 contains a broken access control vulnerability caused by ExternalAuthenticationService.createCustomerAndUser attaching unverified external authentication methods to existing users, letting attackers bind identities to victim accounts and access personal data, exploit requires custom external authentication strategy that does not verify email ownership.
- 7.5 /10 HighCVE-2026-63460 No auth
Vendure - Denial of Service
Vendure prior to 3.6.5 contains a denial of service caused by catastrophic backtracking in regex patterns supplied via Shop GraphQL API StringOperators.regex, letting unauthenticated attackers block request processing and make storefront and admin API unavailable, exploit requires unauthenticated access to public ShopProductsResolver.products.
- 8.7 /10 HighCVE-2026-63459 Auth required
Vendure - Stored XSS
Vendure < 3.6.5 contains a stored XSS caused by assigning administrator-controlled markup to innerHTML in RichTextDescriptionCell, letting lower-privilege administrators execute scripts when viewed by other admins, exploit requires admin privileges.
- 9.8 /10 CriticalCVE-2026-62108 No auth
Headless Single Sign On - Authentication Bypass
Headless Single Sign On <= 1.7.0 contains a broken authentication vulnerability caused by unauthenticated access, letting attackers bypass authentication, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-62104 No auth
Migratico Lite - Remote Code Execution
Migratico Lite <= 2.6.8 contains a remote code execution caused by unauthenticated access, letting remote attackers execute arbitrary code, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-62101 No auth
EduAdmin Booking - Authentication Bypass
EduAdmin Booking <= 5.4.2 contains a broken authentication vulnerability caused by unauthenticated access, letting attackers bypass authentication, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-56795 Auth required
Dell Server Update Utility - Code Execution
Dell Server Update Utility < 26.07.01 contains an uncontrolled search path element vulnerability caused by improper path handling, letting low privileged local attackers execute code, exploit requires local access.
- 8.8 /10 HighCVE-2026-54916 No auth
NetBox Device Type Library - Remote Code Execution
NetBox Device Type Library contains a code execution vulnerability caused by module shadowing via unauthenticated contributor adding malicious files in tests directory, letting attackers execute arbitrary code on GitHub Actions runner, exploit requires ability to submit pull requests.
- 9.1 /10 CriticalCVE-2026-54767 No auth
WeGIA - Command Injection
WeGIA < 3.8.5 contains a command injection caused by unauthenticated access to a GET endpoint with a hardcoded key allowing TRUNCATE TABLE operations, letting remote attackers permanently delete database records, exploit requires knowledge of the hardcoded key and database truncation privileges.
- 9.6 /10 CriticalCVE-2026-54752 No auth
NetBox Device Type Library - Remote Code Execution
NetBox Device Type Library contains an insecure deserialization vulnerability caused by untrusted pickle file loading in test harness, letting unauthenticated contributors execute arbitrary code during test runs, exploit requires crafted pickle files and configuration modification.
- 10.0 /10 CriticalCVE-2026-54734 No auth
Prebid Server Java - Server Side Request Forgery
Prebid Server Java < 3.43.0 contains a server side request forgery caused by improper validation of user-supplied parameters in outbound request URLs, letting attackers cause the server to send requests to unintended destinations, exploit requires attacker to supply bid-request parameters.
- 7.5 /10 HighCVE-2026-54716 No auth
Valhalla - Denial of Service
Valhalla <= 3.7.0 contains a denial of service caused by zero-area exclude_polygons with three collinear points in /sources_to_targets POST request, letting unauthenticated attackers cause unbounded memory growth and crash the worker, exploit requires crafted POST request with specific geometry.
- 7.8 /10 HighCVE-2026-54692 No auth
SAIL - Buffer Overflow
SAIL < 1.0.0 contains a heap overflow caused by improper handling of X10 static short files in sail_codec_load_frame_v8_xbm(), letting attackers cause crashes or potentially execute code, exploit requires loading crafted XBM images.
- 8.8 /10 HighCVE-2026-54671 Auth required
WeGIA - Broken Access Control
WeGIA < 3.8.5 contains a broken access control caused by mapping InternoControle to an empty resource array treated as unconditional access, letting low-privileged authenticated users read, modify, or delete others' records, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-54670 No auth
WeGIA - Broken Access Control & Path Traversal
WeGIA < 3.8.5 contains a broken access control and path traversal caused by lack of controller and method allowlist and improper include path handling in contribution request dispatcher, letting unauthenticated remote attackers disclose sensitive data and invoke financial operations, exploit requires no authentication.