Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 5 of 677
- 7.4 /10 HighCVE-2026-109829 No auth
undici - Cache Poisoning & Information Disclosure
undici 7.0.0 to 7.30.0 and 8.0.0 to 8.12.1 contain a cache poisoning and information disclosure vulnerability caused by improper cache key handling after cross-origin redirects in originless Agent with shared cache, letting attackers poison cache or disclose private data, exploit requires use of originless Agent with shared cache and redirect-then-cache composition.
- 7.4 /10 HighCVE-2026-109383 No auth
undici - Authentication Bypass
undici 4.0.0 to 6.29.0, 7.0.0 to 7.30.0, and 8.0.0 to 8.12.1 contain a broken authentication caused by JSON-based deep cloning dropping custom checkServerIdentity callbacks in TLS options, letting attackers bypass custom TLS certificate verification, exploit requires passing a function-valued tls option.
- 9.1 /10 CriticalCVE-2026-55240 Auth required
Tianji - Server-Side Template Injection
Tianji < 1.31.29 contains a server-side template injection caused by unsafe use of lodash template() with default evaluate pattern in survey and monitor templates, letting workspace administrators execute arbitrary server-side JavaScript via public survey.submit endpoint, exploit requires workspace administrator to store malicious template.
- 8.7 /10 HighCVE-2026-109449 No auth
Symfony Expression Language - Denial of Service
Symfony Expression Language < 5.4.54, < 6.4.48, < 7.4.21, and < 8.1.9 contains a denial of service caused by unbounded expression tree depth in the parser, letting attackers crash the PHP process by submitting deeply nested expressions, exploit requires sending crafted expressions.
- 9.4 /10 CriticalCVE-2026-105474 Auth required
SolusVM - Server-Side Template Injection
SolusVM <= 2.0.0-44576 contains a server-side template injection caused by improper input handling, letting remote authenticated users execute arbitrary code as root, exploit requires user authentication.
- 7.4 /10 HighCVE-2026-111280 No auth
snap7 - Buffer Overflow
snap7 through 1.4.3 contains a buffer overflow caused by unchecked DataLength field in TSnap7MicroClient::opReadArea(), letting malicious S7 peers crash processes and corrupt memory, exploit requires crafted ReadVar responses from rogue or impersonated PLCs.
- 9.3 /10 CriticalCVE-2026-47218 No auth
runwasi containerd-shim-wasmtime-v1 - Remote Code Execution
runwasi containerd-shim-wasmtime-v1 < 0.6.1 contains a remote code execution caused by trusting and deserializing precompiled Wasmtime bytes from OCI image layers, letting attackers execute native code in the shim process, exploit requires victim to run crafted image.
- 7.5 /10 HighCVE-2026-104827 No auth
ReactPHP react/http - Denial of Service
ReactPHP react/http 1.0.0 to 1.11.1 contains a denial of service caused by unbounded response-header buffering in ClientRequestStream::handleData(), letting remote servers exhaust PHP memory and crash processes, exploit requires attacker-controlled URLs.
- 8.2 /10 HighCVE-2026-101307 No auth
RACK stack - Out-of-Bounds Write
The RACK stack contains an out-of-bounds write caused by repeated doubling of a 16-bit allocation counter that wraps to zero during PCM sample array expansion, letting remote attackers cause kernel panic by sending many ACKs on an established TCP connection.
- 7.1 /10 HighCVE-2026-53582 PoC publicAuth required
OPNsense - XPath Injection
OPNsense < 26.1.10 contains an XPath injection caused by interpolation of attacker-controlled certificate authority and certificate refid values in Trust module, letting users with CA or Certificate Manager privileges recover sensitive config.xml values, exploit requires CA Manager or Certificate Manager privileges.
- 9.9 /10 CriticalCVE-2026-57155 PoC publicAuth required
OPNsense - Path Traversal & Remote Code Execution
OPNsense < 26.1.11 contains a path traversal in Firewall Alias GeoIP importer's process_zip() and process_gzip() caused by unvalidated CSV country_code, letting attackers with Firewall Alias Edit privilege write files as root and execute commands, exploit requires Firewall Alias Edit privilege.
- 9.1 /10 CriticalCVE-2026-111235 No auth
OpenNMS Meridian & Horizon - Authorization Bypass
OpenNMS Meridian and Horizon contain an authorization bypass caused by case-sensitive HTTP method checks missing terminal deny rules in REST API Spring Security filter chains, letting remote unauthenticated attackers read and modify resources, exploit requires sending requests with non-canonical HTTP methods.
- 7.5 /10 HighCVE-2026-100409 No auth
OpenNext Cloudflare - Authorization Bypass
OpenNext Cloudflare 0.3.0 to 1.20.2 contains an authorization bypass caused by inconsistent processing of encoded pathnames between middleware and cache lookup, letting unauthenticated attackers access cached protected content, exploit requires enabled cache interception and matching cached protected routes.
- 7.7 /10 HighCVE-2026-111312 No auth
OpenHealth - Broken Access Control
OpenHealth <= 0.2.0 contains a broken access control vulnerability caused by missing authentication and authorization checks in /api/health-data/[id] GET, PATCH, and DELETE handlers, letting unauthenticated attackers read, modify, or delete other users' medical records by knowing the record id, exploit requires knowledge of a valid HealthData record id.
- 9.8 /10 CriticalCVE-2026-84731 No auth
Nutanix Prism Element - Authentication Bypass
Nutanix Prism Element contains an authentication bypass caused by misconfigured authentication filters and crafted internal management HTTP header, letting unauthenticated remote attackers gain full administrative access and execute root commands, exploit requires crafted internal management HTTP header.