Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 482 of 695
- 7.5 /10 HighCVE-2026-92719 No auth
Quickwit - Server Side Request Forgery
Quickwit <= 0.9.0 contains a server-side request forgery caused by improper validation of host and scheme in the queue_url parameter in SQS file sources, letting attackers make requests to arbitrary internal addresses, exploit requires attacker to supply a malicious queue_url to the create-source API.
- 7.3 /10 HighCVE-2026-92718
Nuclei - Command Injection
Nuclei < 3.11.1 contains a command injection caused by caching template signature verification based only on file modification time without content checksums, letting attackers replace verified templates with malicious content to execute arbitrary OS commands, exploit requires ability to replace template files.
- 9.1 /10 CriticalCVE-2026-92717 No auth
Covenant - Authentication Bypass
Covenant <= 0.6 contains a broken authentication caused by missing Authorize attribute on CovenantHub SignalR hub, letting unauthenticated attackers obtain signed JWT tokens and access operator API, exploit requires no authentication.
- 9.6 /10 CriticalCVE-2026-92716 Auth required
Shuffle - Privilege Escalation
Shuffle 2.2.1 contains a privilege escalation caused by improper access control in HandleApiGeneration endpoint, letting administrators reset and read API keys of users in other organizations, exploit requires admin privileges.
- 7.5 /10 HighCVE-2026-92626 No auth
Control iD iDSecure - Denial of Service
Control iD iDSecure < 4.8.3.0 contains a denial of service caused by dereferencing an unset DGuard integration login state in /api/dguardintegration/dguardVersion, letting unauthenticated attackers terminate the process, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-92625 No auth
Control iD iDSecure - Denial of Service
Control iD iDSecure < 4.8.3.0 contains an unauthenticated denial of service caused by unrestricted access to /api/license/restartService endpoint, letting remote attackers repeatedly restart the service, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-92604 Auth required
Scirius - Unrestricted File Upload
Scirius <= 3.8.0 contains an unrestricted file write vulnerability caused by path traversal in the PCAP filestore upload endpoint, letting default User role attackers write arbitrary JSON files as root, exploit requires user role access.
- 7.1 /10 HighCVE-2026-92602 Auth required
TDuck survey form - Broken Access Control
TDuck survey form through 5.3 contains a broken access control vulnerability caused by lack of webhook URL validation and form ownership verification in WebhookConfigController, letting authenticated attackers attach webhooks to other users' forms and exfiltrate submissions.
- 7.5 /10 HighCVE-2026-92599 No auth
joi - Regular Expression Denial of Service
joi (npm package) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 contain a regular expression denial of service caused by an unanchored regex in Joi.string().isoDate() validation, letting remote attackers stall the application with crafted input, exploit requires attacker to supply a long fractional-second ISO date string.
- 7.5 /10 HighCVE-2026-92596 No auth
Nodemailer - Denial of Service
Nodemailer < 9.1.0 contains a denial of service caused by quadratic time complexity in the addressparser component, letting remote attackers freeze the Node.js event loop by sending crafted large address lists, exploit requires sending crafted email.
- 7.5 /10 HighCVE-2026-92594 No auth
Craft CMS - Broken Access Control
Craft CMS 5.0.0-RC1 through < 5.11.0 contains an information disclosure caused by incorrect authorization of GraphQL draftCreator and revisionCreator fields, letting clients with drafts or revisions scope access sensitive user data, exploit requires access to GraphQL drafts or revisions scope.
- 8.8 /10 HighCVE-2026-92593 Auth required
Craft CMS - Server-Side Template Injection
Craft CMS 5.10.0 through 5.10.12 contains a server-side template injection caused by unsandboxed View::renderObjectTemplate() sink and token misuse, letting authenticated low-privilege control panel users execute arbitrary PHP code, exploit requires edit rights on a single element type.
- 8.8 /10 HighCVE-2026-92592 PoC publicAuth required
Craft CMS - Remote Code Execution
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 contain a remote code execution caused by improper HMAC signature binding in license-shun cookie and redirect parameters, letting authenticated non-admin users execute arbitrary OS commands via unsandboxed Twig templates, exploit requires password authentication without 2FA and PHP system() availability.
- 7.1 /10 HighCVE-2026-92582 No auth
AVideo - Cross-Site Request Forgery
AVideo (WWBN/AVideo) through 29.0 contains a cross-site request forgery caused by disabled CSRF and untrusted-request checks in objects/videoAddNew.json.php, letting attackers modify video records via crafted cross-origin requests, exploit requires victim to be authenticated with upload rights.
- 8.8 /10 HighCVE-2026-92580 No auth
AVideo CloneSite - Command Injection
AVideo through 29.0 CloneSite plugin contains a stored OS command injection caused by improper escaping of SSH password in command string, letting unauthenticated remote attackers execute arbitrary commands via CSRF on admin, exploit requires enabled plugin with crontab and CSRF vulnerability.