Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 488 of 681

  • 7.4 /10 High
    CVE-2026-61592

    djust - Broken Access Control

    djust < 1.0.7 contains a broken access control vulnerability caused by SSE sessions keyed only by client-chosen session_id without binding to authenticated user, letting attackers dispatch event handlers as victim, exploit requires attacker to know or obtain session_id.

  • 8.1 /10 High
    CVE-2026-61591 Auth required

    djust - Broken Access Control

    djust < 1.0.7 contains a broken access control vulnerability caused by unsigned state_json snapshots in client pages, letting attackers modify view attributes to escalate privileges or tamper with business state, exploit requires state snapshots enabled.

  • 7.4 /10 High
    CVE-2026-61590 No auth

    djust - Broken Access Control

    djust < 1.0.7 contains an information disclosure caused by missing localhost restriction on observability endpoints, letting remote attackers read live application state and invoke handlers, exploit requires DEBUG mode enabled and no localhost middleware.

  • 7.8 /10 High
    CVE-2026-59974 No auth

    Stanza - Path Traversal & Remote Code Execution

    Stanza < 1.14.0 contains a path traversal caused by unvalidated extraction of archive member paths in stanza.resources.common.unzip, letting attackers overwrite files and potentially execute code, exploit requires crafted malicious archive.

  • 7.5 /10 High
    CVE-2026-59969

    Apache ZooKeeper - Authentication Bypass

    Apache ZooKeeper contains a broken authentication caused by failure to enforce peer hostname verification in FIPS-mode quorum TLS, letting malicious peers join quorum traffic and participate in leader election, exploit requires specific TLS and FIPS mode settings enabled.

  • 7.5 /10 High
    CVE-2026-59739

    Apache ZooKeeper - Information Disclosure

    Apache ZooKeeper contains an information disclosure vulnerability caused by missing ACL check in SetWatches reconnect replay, letting attackers discover ACL-restricted paths by registering exists-watches on non-existent paths and reconnecting after path creation, exploit requires ability to register watches and reconnect.

  • 9.8 /10 Critical
    CVE-2026-51990 CISA KEVPoC publicNo auth

    Sogou Sogou Input Method - Remote Code Execution

    Sogou Sogou Input Method < 16.3.0.3498 contains a remote code execution caused by vulnerability in biz_helper.exe component, letting remote attackers execute arbitrary code, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-47094 Auth required

    SIMAC MyPHR - Broken Access Control

    SIMAC MyPHR 1.1 contains a broken access control caused by missing server-side ownership validation in the employee update endpoint, letting authenticated attackers access and modify arbitrary employee records.

  • 7.5 /10 High
    CVE-2026-46352 No auth

    Suricata - Denial of Service

    Suricata 8.0.0 to < 8.0.5 contains a denial of service caused by deadlock in IP defragmentation code when processing fragmented traffic with encapsulated tunnel protocol payloads, letting attackers cause service disruption, exploit requires crafted fragmented traffic.

  • 7.4 /10 High
    CVE-2026-42784

    sequoia-openpgp - Authentication Bypass

    sequoia-openpgp contains a cryptographic integrity bypass caused by incorrect inference of key flags for older certificates missing key flags subpacket, letting attackers forge signatures and bind arbitrary subkeys, exploit requires crafted certificates.

  • 7.5 /10 High
    CVE-2026-38999 No auth

    Monkey - Denial of Service

    Monkey contains a null pointer dereference caused by improper handling in mk_sched_event_close function, letting attackers cause denial of service via crafted HTTP requests, exploit requires sending crafted requests.

  • 9.8 /10 Critical
    CVE-2026-27565 No auth

    Unspecified Product - Unrestricted File Upload

    An unspecified product contains an unrestricted file upload vulnerability caused by allowing unauthenticated remote attackers to upload malicious IODD files, letting attackers execute persistent shell scripts with root privileges, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-27564 Auth required

    Unknown Vendor Unknown Product - Command Injection

    An unspecified vendor's product contains a command injection caused by improper input handling in the /api/datastorage/data endpoint, letting high-privileged remote attackers execute commands with root privileges, exploit requires admin credentials.

  • 7.2 /10 High
    CVE-2026-27563 Auth required

    Unspecified Product - Command Injection

    An unspecified product contains a command injection caused by crafted GET request to /api/datastorage/data endpoint, letting high-privileged remote attackers execute commands with root privileges, exploit requires admin credentials.

  • 7.2 /10 High
    CVE-2026-27562 Auth required

    Device - Command Injection

    A device contains a command injection caused by crafted PUT requests to /api/iodd/config with admin credentials, letting high-privileged remote attackers execute commands with root privileges.