Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 477 of 695
- 9.8 /10 CriticalCVE-2026-54460
OpenReception Appointment Booking Software - Authentication Bypass
OpenReception appointment booking software < 1.1.1 contains an authentication bypass caused by missing WebAuthnService.verifyRegistration and improper passkey binding, letting unauthenticated attackers create staff sessions and access tenant data, exploit requires knowledge of public tenant ID and target staff email.
- 8.1 /10 HighCVE-2026-54446 No auth
NetLicensing MCP Server - Broken Access Control
NetLicensing MCP Server < 0.1.6 contains a broken access control caused by missing authentication checks in ApiKeyMiddleware, letting unauthenticated attackers manage licensing objects and perform destructive operations, exploit requires no user interaction.
- 8.2 /10 HighCVE-2026-54354 No auth
MapServer - SQL Injection
MapServer < 8.6.4 contains a SQL injection caused by improper validation of numeric literals in PostGIS runtime filter translation, letting unauthenticated remote attackers bypass predicates and enumerate records via crafted input.
- 7.7 /10 HighCVE-2026-54339 Auth required
Glean - Server-Side Request Forgery
Glean < 0.2.6 contains a server-side request forgery caused by lack of network-level validation on feed URLs in feed fetching components, letting attackers retrieve internal or cloud metadata resources, exploit requires attacker to supply malicious feed URL.
- 8.2 /10 HighCVE-2026-54253 No auth
TS3 Manager - Stored XSS & Information Disclosure
TS3 Manager < 2.2.6 contains a stored XSS caused by improper handling of the port query parameter in /api/download and insecure token cookie attributes, letting logged-in operators execute scripts and hijack sessions, exploit requires valid operator session and user interaction.
- 8.8 /10 HighCVE-2026-54239 Auth required
Faust.js FaustWP - Broken Access Control
Faust.js FaustWP WordPress plugin < 1.8.11 contains a broken access control caused by excluding the initialization vector from HMAC validation in token encryption, letting logged-in non-administrators escalate to administrator privileges and execute arbitrary code, exploit requires logged-in non-administrator access.
- 9.6 /10 CriticalCVE-2026-54053 Auth required
Many Notes - Path Traversal & Stored XSS
Many Notes < 0.16.0 contains a path traversal and stored XSS caused by improper validation of ZIP archive filenames in vault import, letting authenticated users write arbitrary files and execute scripts in other users' vaults, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-52851 Auth required
Traccar - SQL Injection
Traccar < 6.14.0 contains a SQL injection caused by improper validation of extra JSON keys in DELETE /api/permissions, letting authenticated non-readonly users extract database values or delete permission rows.
- 7.2 /10 HighCVE-2026-52727
LXC-ci Arch Linux - Authentication Bypass
LXC-ci Arch Linux images built before 2026-05-28 contain a privilege escalation caused by redistribution of pacman local-signing private key in /etc/pacman.d/gnupg, letting attackers controlling HTTP mirrors execute arbitrary code as root, exploit requires attacker to control or intercept mirror traffic.
- 8.8 /10 HighCVE-2026-52483 Auth required
MitraStar GPT-2741GNAC-N2-SV - Command Injection
MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 contains a command injection caused by concatenated parameters in /cgi-bin/device-management-utilities-internet.cgi, letting authenticated users execute arbitrary OS commands.
- 7.5 /10 HighCVE-2026-50285 No auth
Pomerium - Denial of Service
Pomerium < 0.32.8 contains a denial of service caused by unbounded zstd decompression of attacker-controlled data in decodeQueryStringV2, letting unauthenticated attackers exhaust memory and crash the proxy, exploit requires attacker to obtain receiver key and send crafted compressed payload.
- 7.5 /10 HighCVE-2026-50277 No auth
Datadog dd-trace-cpp - Denial of Service
Datadog dd-trace-cpp < 2.1.0 contains a denial of service caused by lack of enforcement of baggage size limits during extraction of W3C baggage headers, letting remote unauthenticated attackers cause unbounded CPU and memory consumption, exploit requires sending crafted headers.
- 7.5 /10 HighCVE-2026-50275 No auth
Datadog PHP Tracer - Denial of Service
Datadog PHP Tracer < 1.19.2 contains a denial of service caused by unbounded parsing of W3C baggage HTTP headers in ddtrace_deserialize_baggage, letting remote unauthenticated clients exhaust CPU and memory, exploit requires sending large or oversized baggage headers.
- 7.7 /10 HighCVE-2026-50158 No auth
Yutu - Unrestricted File Upload
Yutu < 0.10.9 contains an unrestricted file write vulnerability caused by improper path handling in caption-download MCP tool, letting a principal able to invoke caption-download write files outside YUTU_ROOT, exploit requires access to caption-download functionality and service credentials.
- 7.5 /10 HighCVE-2026-50125 No auth
MKP - Denial of Service
MKP < 0.4.1 contains a denial of service caused by unbounded memory allocation in pod logs handling, letting remote attackers exhaust server memory and terminate the service, exploit requires network access to default port 8080.