Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 481 of 695
- 8.8 /10 HighCVE-2026-92780 Auth required
KnowStreaming - Broken Access Control
KnowStreaming through 3.4.1 contains a broken access control vulnerability caused by failure to enforce role-based access control on REST API endpoints, letting authenticated users escalate privileges to administrator, exploit requires authentication.
- 7.6 /10 HighCVE-2026-92779 Auth required
Builder.io Gen2 SDKs - Prototype Pollution
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability caused by unvalidated processing of content block bindings in the deep-set helper function, letting attackers pollute Object.prototype during rendering, exploit requires crafted content blocks with specific binding keys.
- 8.1 /10 HighCVE-2026-92776 Auth required
Wiki.js - Broken Access Control
Wiki.js through 2.5.314 contains a broken access control caused by failure to require path separators when matching START and END page rules, letting attackers with folder access read and modify unrelated pages with matching prefixes, exploit requires user to have folder access.
- 7.1 /10 HighCVE-2026-92773
Trigger.dev - Broken Access Control
Trigger.dev < 4.6.0 contains a broken access control caused by failure to verify authenticated user ownership of GitHub App installation, letting attackers claim others' installations and access repositories, exploit requires replaying state cookies and sequential installation IDs.
- 7.1 /10 HighCVE-2026-92772 Auth required
Leantime - Authorization Bypass
Leantime before 3.9.6 contains an authorization bypass caused by lack of permission validation in the HTMX plugin install endpoint, letting authenticated users with limited roles install malicious plugins, exploit requires authentication.
- 8.1 /10 HighCVE-2026-92763 Auth required
Rundeck - Broken Access Control
Rundeck <= 6.2.1 contains a broken access control caused by improper authorization of importConfig and importNodesSources parameters in the project archive import endpoint, letting attackers with import action replace security-relevant project configuration files, exploit requires import action privilege.
- 8.8 /10 HighCVE-2026-92762 Auth required
Pelican Panel - Broken Access Control
Pelican Panel < 1.0.0-beta35 contains a broken access control vulnerability caused by enforcing startup write permissions only through disabled form controls, letting attackers with startup.read permission execute arbitrary commands in the container via Livewire state updates.
- 8.8 /10 HighCVE-2026-92761 Auth required
WebVirtCloud - Broken Access Control
WebVirtCloud contains a broken access control caused by improper validation of permission flags in UserInstance grants, letting attackers with read-only grants perform privileged actions, exploit requires attacker to have read-only grants.
- 7.1 /10 HighCVE-2026-92753 Auth required
PatrowlManager - Authorization Bypass
PatrowlManager through 1.8.4 contains an authorization bypass caused by lack of ownership filtering in events and alerts API endpoints, letting authenticated attackers read, delete, and modify other users' events and alerts.
- 8.3 /10 HighCVE-2026-92752 Auth required
metasfresh - Broken Access Control
metasfresh contains a broken access control caused by lack of record-level permission enforcement in DocumentAttachmentsRestController and CommentsRestController endpoints, letting logged-in attackers read, replace, and delete attachments and comments on unauthorized records, exploit requires attacker to be logged in.
- 8.1 /10 HighCVE-2026-92751 No auth
CMAK - Cross-Site Request Forgery
CMAK <= 3.0.0.6 contains a cross-site request forgery vulnerability caused by missing CSRF filter installation, letting attackers perform state-changing actions on behalf of authenticated operators, exploit requires operator authentication.
- 8.1 /10 HighCVE-2026-92749
SafeLine - Authentication Bypass
SafeLine through 9.4.1 contains a broken authentication caused by deriving the management console session-signing secret from a time-seeded math/rand generator, letting unauthenticated remote attackers forge valid administrator session cookies, exploit requires bounding the install timestamp.
- 8.8 /10 HighCVE-2026-92748 Auth required
BC Security Empire - Path Traversal
BC Security Empire < 6.7.1 contains a path traversal caused by improper validation of multipart filename parameter in upload endpoints, letting authenticated operators write files to arbitrary paths for code execution.
- 8.2 /10 HighCVE-2026-92729 No auth
SigNoz - Broken Access Control
SigNoz 0.88.0 through 0.141.0 contains a broken access control caused by missing authorization wrappers on trace-funnel analytics endpoints, letting unauthenticated attackers retrieve sensitive trace analytics without credentials.
- 9.1 /10 CriticalCVE-2026-92720 No auth
Kubero - Broken Access Control
Kubero <= 3.1.1 contains a broken access control vulnerability caused by missing authentication guards on notifications API endpoints, letting unauthenticated attackers read webhook secrets and modify configurations, exploit requires no authentication.