Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 480 of 695
- 9.8 /10 CriticalCVE-2026-92805 PoC publicNo auth
UVdesk Community Skeleton - Authentication Bypass
UVdesk Community Skeleton through 1.1.8 contains a broken authentication caused by failure to validate installation state on wizard endpoints in ConfigureHelpdesk controller, letting unauthenticated attackers create super administrator accounts, exploit requires crafted requests to wizard endpoints.
- 7.1 /10 HighCVE-2026-92804 Auth required
Nango - Server Side Request Forgery
Nango <= 0.70.4 contains a server-side request forgery caused by failure to validate caller-supplied connection configuration values in provider token and proxy URL templates, letting authenticated attackers exfiltrate provider credentials via internal or cloud metadata endpoints.
- 8.8 /10 HighCVE-2026-92801 Auth required
cc-connect - Broken Access Control
cc-connect through 1.5.0 contains a broken access control caused by failure to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks, letting attackers dispatch agent commands bypassing access controls, exploit requires attacker to trigger card actions in admitted chats.
- 8.8 /10 HighCVE-2026-92796 Auth required
Manticore Search - Broken Access Control
Manticore Search > 27.0.0 < 28.4.4 contains a broken access control caused by failure to validate permissions for all statements in multi-statement SQL requests, letting read-only attackers execute unauthorized queries and access credential tables, exploit requires ability to send multi-statement SQL queries.
- 7.5 /10 HighCVE-2026-92794 No auth
OpenSign - Authentication Bypass
OpenSign through 2.41.3 contains an information disclosure vulnerability caused by failure to validate caller identity in the getDocument cloud function when one-time-password verification is disabled, letting attackers retrieve complete document details without authentication.
- 8.1 /10 HighCVE-2026-92793 Auth required
GoAdmin - Broken Access Control
GoAdmin <= 1.2.26 contains a broken access control caused by improper anchoring of the logout pattern in permission checks, letting authenticated users bypass permissions to access admin endpoints, exploit requires authentication.
- 7.5 /10 HighCVE-2026-92792 No auth
OpenNHP - Authentication Bypass
OpenNHP through 1.0.2 contains an authentication bypass caused by attacker-supplied evidence with a test_purpose key triggering unconditional FallbackVerifier execution, letting attackers bypass attestation verification and gain unauthorized access, exploit requires attacker to provide enrolled measure and serial number pairs.
- 7.5 /10 HighCVE-2026-92791 No auth
Uber Kraken - Path Traversal
Uber Kraken through 0.1.29 contains a path traversal caused by improper validation of the tag parameter in the /tags/{tag} endpoint, letting unauthenticated attackers read arbitrary files accessible to the backend.
- 8.8 /10 HighCVE-2026-92788 Auth required
Coze Studio - Broken Access Control
Coze Studio <= 0.5.1 contains a broken access control caused by failure to validate table names in workflow SQL customization nodes, letting authenticated attackers read, insert, or delete data in other workspaces' memory databases, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-92787 No auth
Feast - Authentication Bypass
Feast <= 0.66.0 contains a broken authentication caused by failure to verify JWT token signatures before user identity establishment, letting attackers bypass role-based access control and gain full read/write access, exploit requires presenting an unverified token with a hardcoded claim.
- 7.8 /10 HighCVE-2026-92786 No auth
LightGBM - Out of Bounds Write
LightGBM <= 4.7.0 contains an out-of-bounds write vulnerability caused by improper validation of child and split array values when parsing text models, letting attackers write out-of-bounds memory during SHAP prediction, exploit requires crafted malicious model files.
- 8.1 /10 HighCVE-2026-92785 No auth
Angel - Insecure Deserialization
Angel through 3.3.0 contains an insecure deserialization vulnerability caused by untrusted setAlgoMetrics payload deserialized using Kryo without class registration or allowlist validation, letting unauthenticated network attackers execute arbitrary code or exhaust memory by sending crafted serialized objects to the master RPC endpoint.
- 7.5 /10 HighCVE-2026-92784
@refinedev/inferencer - Stored XSS
@refinedev/inferencer <= 7.0.0 contains a stored XSS caused by failure to escape API field names in generated JSX, letting attackers controlling data provider execute malicious JavaScript in developer's browser, exploit requires attacker control of data provider.
- 8.1 /10 HighCVE-2026-92783 Auth required
Yeti - Broken Access Control
Yeti through 2.11.0 contains a broken access control vulnerability caused by failure to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, letting users with read access delete access control relationships, exploit requires user to have read access.
- 8.1 /10 HighCVE-2026-92782 Auth required
Chroma - Broken Access Control
Chroma <= 1.5.9 contains a broken access control caused by failure to validate tenant and database segments when resolving collections, letting authenticated attackers read and modify records in other tenants' collections, exploit requires authentication.