Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 487 of 681

  • 7.5 /10 High
    CVE-2026-70469 No auth

    Apache NiFi - Denial of Service

    Apache NiFi 2.11.0 contains a denial of service vulnerability caused by improper handling of multiple or non-standard gzip Content-Encoding headers in the REST API, letting attackers consume excessive memory, exploit requires sending crafted HTTP requests.

  • 10.0 /10 Critical
    CVE-2026-70416 No auth

    Dell ObjectScale - Remote Code Execution

    Dell ObjectScale < 4.4.0.0 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting unauthenticated remote attackers execute arbitrary code remotely, exploit requires remote access.

  • 7.0 /10 High
    CVE-2026-68904 No auth

    node-opcua - Denial of Service

    node-opcua 2.0.0 to 2.170.0 contains a denial of service caused by repeated reconnection cycles due to server clock skew triggering BadInvalidTimestamp responses, letting remote attackers exhaust client resources, exploit requires default keepSessionAlive setting.

  • 9.8 /10 Critical
    CVE-2026-68536 No auth

    Apache MyFaces Core - Server-Side Request Forgery & Local File Inclusion

    Apache MyFaces Core contains a server-side request forgery and local file inclusion caused by improper input validation, letting attackers make arbitrary server requests or include local files, exploit requires crafted requests.

  • 7.5 /10 High
    CVE-2026-65388

    Containerization - Open Redirect

    Containerization < 0.41.0 contains an open redirect caused by manipulation of token request redirection, letting remote attackers disclose victim's registry credentials, exploit requires attacker to control a container registry.

  • 8.1 /10 High
    CVE-2026-63671 No auth

    @nuxtjs/mdc - Stored XSS

    @nuxtjs/mdc < 0.22.1 contains a stored XSS caused by improper sanitization of SVG xlink:href and iframe src with data:text/html, letting attackers execute JavaScript in page origin, exploit requires untrusted Markdown input.

  • 8.8 /10 High
    CVE-2026-63506 Auth required

    Tina - Broken Access Control

    Tina headless CMS prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1 contains a broken access control caused by improper validation of bearer tokens against attacker-controlled client IDs, letting attackers perform unauthorized media and content operations across tenant boundaries without victim interaction.

  • 7.8 /10 High
    CVE-2026-63325 No auth

    Redocly CLI - Command Injection

    Redocly CLI < 2.33.0 contains a command injection caused by dynamic evaluation of $faker runtime expressions in Arazzo descriptions, letting attackers execute arbitrary code with CLI process privileges, exploit requires processing untrusted descriptions.

  • 7.5 /10 High
    CVE-2026-63128 No auth

    RMCP - Denial of Service

    RMCP Rust SDK < 2.0.0 contains a denial of service caused by improper session management in StreamableHttpService::handle_post, letting unauthenticated clients exhaust memory and degrade server performance, exploit requires sending crafted JSON-RPC POST requests.

  • 8.2 /10 High
    CVE-2026-63127 No auth

    RMCP - Authentication Bypass

    RMCP Rust SDK < 2.0.0 contains an OAuth authorization bypass caused by omission of RFC 9728 resource field validation in ResourceServerMetadata, letting malicious MCP servers impersonate victims by capturing access tokens, exploit requires victim to complete authorization flow.

  • 7.5 /10 High
    CVE-2026-63126 No auth

    Wire - Denial of Service

    Wire protobuf readers prior to 6.4.5 and 7.0.0-alpha04 contain a denial of service vulnerability caused by inconsistent validation of attacker-controlled lengths in protobuf decoding, letting attackers cause crashes or excessive allocation, exploit requires supplying malformed protobuf bytes.

  • 7.1 /10 High
    CVE-2026-61596 Auth required

    djust - Broken Access Control

    djust < 1.0.7 contains a broken access control vulnerability caused by missing per-object authorization enforcement on HTTP GET, SPA url_change, and live_render paths, letting authenticated users access unauthorized objects, exploit requires authentication.

  • 7.7 /10 High
    CVE-2026-61595 Auth required

    djust - Broken Access Control

    djust before 1.0.7 contains a broken access control caused by tenant isolation enforced only on HTTP path and tenant leakage via threading.local() in WebSocket/SSE, letting attackers access other tenants' data, exploit requires WebSocket/SSE connection.

  • 9.1 /10 Critical
    CVE-2026-61594 No auth

    djust - Authentication Bypass

    djust < 1.0.7 contains an authentication bypass caused by WebSocket transport not enforcing Django's standard authorization checks, letting anonymous or under-privileged clients access and dispatch admin views, exploit requires WebSocket access.

  • 8.1 /10 High
    CVE-2026-61593 No auth

    djust - Cross-Site Request Forgery

    djust prior to 1.0.7 contains a cross-site request forgery caused by missing CSRF and Origin checks on SSE POST and GET endpoints, letting cross-origin attackers trigger state-changing events as authenticated victims, exploit requires victim's browser to be authenticated and visit attacker-controlled page.