Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 483 of 681
- 8.0 /10 HighCVE-2026-85469
quay-builder-qemu - Command Injection
quay-builder-qemu contains a code injection vulnerability caused by using a mutable branch in the pinned upstream Noelware/docker-manifest-action in the release workflow, letting remote attackers inject arbitrary code, exploit requires compromise of the mutable branch.
- 7.1 /10 HighCVE-2026-85387 Auth required
Concrete CMS - Broken Access Control
Concrete CMS < 9.5.4 contains a broken access control vulnerability caused by re-authorizing OAuth REST API requests based solely on bearer tokens without re-checking account state, letting attackers with valid tokens access API endpoints despite user deactivation, deletion, or lockout, exploit requires valid bearer token.
- 9.6 /10 CriticalCVE-2026-85385 No auth
Concrete CMS - Stored XSS
Concrete CMS < 9.5.4 contains a stored cross-site scripting caused by lack of validation and output encoding of user timezone value on the Dashboard user management page, letting attackers execute scripts in administrator sessions, exploit requires concrete.misc.user_timezones enabled and either authenticated user or public registration enabled.
- 7.5 /10 HighCVE-2026-84997 No auth
ReactPHP react/http - Denial of Service
ReactPHP react/http 0.6.0 to 1.11.1 contains a denial of service caused by infinite loop in ChunkedDecoder processing malformed Transfer-Encoding: chunked bodies, letting malicious clients or servers freeze the server or client, exploit requires sending malformed chunked bodies.
- 8.8 /10 HighCVE-2026-84860 Auth required
ScadaLTS - Authorization Bypass
ScadaLTS 2.8.1-release-candidate build 0 contains an authorization bypass caused by disabled DWR origin validation and method dispatch based on POST body parameters, letting authenticated users invoke any DWR method, exploit requires authenticated user access.
- 8.8 /10 HighCVE-2026-84858 Auth required
ScadaLTS - Remote Code Execution
ScadaLTS 2.8.1-release-candidate build 0 contains an authenticated remote code execution caused by scripting sandbox bypass in the DWR DataSourceEditDwr class validateScript method, letting low privilege attackers execute arbitrary JavaScript code remotely, exploit requires attacker to be authenticated with low privileges.
- 8.8 /10 HighCVE-2026-84829 No auth
Optimole WordPress - Stored Cross-Site Scripting
Optimole WordPress plugin < 4.2.12 contains a stored XSS caused by improper escaping of user-supplied values in image tag attributes, letting unauthenticated attackers inject arbitrary attributes, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-84408 Auth required
QND - Broken Access Control
QND contains an improper access control vulnerability in a named pipe, letting a logged-in local attacker execute arbitrary commands with SYSTEM privileges.
- 8.8 /10 HighCVE-2026-82964 Auth required
Avast Sandbox - Broken Access Control
Avast sandbox minifilter driver on Windows contains a broken access control vulnerability caused by improper preservation of file permissions in virtualization, letting local low-privileged attackers escape sandbox and escalate to SYSTEM, exploit requires local sandbox execution.
- 9.8 /10 CriticalCVE-2026-82717
NLnet Labs Unbound - Remote Code Execution
NLnet Labs Unbound <= 1.26.0 contains a heap buffer overflow caused by improper handling of CNAME synthesis and max TTL rewriting in packet buffer, letting remote attackers cause memory corruption or remote code execution, exploit requires crafted upstream response.
- 7.5 /10 HighCVE-2026-82399 No auth
CoreDNS - Denial of Service
CoreDNS < 1.14.7 contains a denial of service caused by improper validation of DNS section counts in DNS-over-HTTPS, HTTP/3, QUIC, and gRPC request paths, letting unauthenticated clients exhaust memory via amplified allocations, exploit requires network access to affected protocols.
- 9.8 /10 CriticalCVE-2026-82311 No auth
Apache Airflow FAB provider - Authentication Bypass
Apache Airflow FAB provider before 3.9.0 contains a broken authentication caused by inconsistent session identifier comparison in database-backed sessions, letting attackers with stolen session cookies maintain access after password reset, exploit requires use of FAB auth manager with database session backend.
- 7.2 /10 HighCVE-2026-82310 Auth required
Apache Airflow FAB provider - Authentication Bypass
Apache Airflow FAB provider in versions before 3.9.0 contains a broken authentication caused by continued acceptance of unexpired tokens for deactivated user accounts in the Core API, letting attackers with valid tokens maintain role-scoped access indefinitely after account deactivation, exploit requires administrative deactivation of the user account.
- 7.5 /10 HighCVE-2026-81876 No auth
HAPI FHIR - Denial of Service
HAPI FHIR < 6.9.12 contains a denial of service caused by an infinite loop in SHCParser when processing malformed Smart Health Card JWTs with empty or truncated raw-DEFLATE payloads, letting attackers exhaust JVM worker threads, exploit requires sending crafted validation requests.
- 7.5 /10 HighCVE-2026-81875 No auth
HAPI FHIR - Denial of Service
HAPI FHIR < 6.9.12 contains a denial of service caused by unbounded decompression of attacker-controlled Smart Health Card JWT content in SHCParser, letting attackers cause excessive memory use and process instability, exploit requires attacker-supplied SHC content.