Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 550 of 677
- 8.0 /10 HighCVE-2026-55225 Auth required
Strimzi - Broken Access Control
Strimzi <= 1.0.0 contains a broken access control vulnerability caused by improper handling of Kafka.spec.entityOperator watchedNamespace, letting attackers with Kafka custom resource creation permissions read or write Secrets in target namespaces, exploit requires ability to create Kafka custom resources.
- 9.8 /10 CriticalCVE-2026-55211 No auth
Surfio - Buffer Overflow
Surfio < 0.0.19 contains a buffer overflow caused by improper validation of size fields in IRAP files, letting attackers cause memory corruption when parsing untrusted files, exploit requires untrusted file input.
- 7.5 /10 HighCVE-2026-55178
GeoLens - Broken Access Control
GeoLens prior to 1.2.3 contains a broken access control vulnerability caused by insufficient authorization checks on related datasets and API endpoints, letting anonymous and authenticated users access private dataset metadata and data, exploit requires crafted API requests referencing private datasets.
- 9.1 /10 CriticalCVE-2026-55158 No auth
Conflibot - Command Injection
Conflibot < 1.2.1 contains a command injection caused by unsafe interpolation of attacker-controlled pull request branch names in exec commands, letting attackers execute arbitrary commands with repository secrets, exploit requires pull_request_target workflow usage.
- 7.5 /10 HighCVE-2026-55149 No auth
Vouch Proxy - Denial of Service
Vouch Proxy < 0.48.0 contains a denial of service caused by unbounded allocation from attacker-controlled multipart cookie name in cookie parsing, letting remote attackers crash the authentication proxy without valid session, exploit requires no authentication.
- 8.3 /10 HighCVE-2026-54549
Meta Ads MCP - Server-Side Request Forgery
Meta Ads MCP < 1.0.115 contains a server-side request forgery caused by unvalidated image_url passed to HTTP client with follow_redirects enabled, letting network attackers access internal services, exploit requires network access with any non-empty authorization.
- 7.4 /10 HighCVE-2026-54547
Meta Ads MCP - Broken Access Control
Meta Ads MCP < 1.0.115 contains a broken access control vulnerability caused by improper authentication token validation in AuthInjectionMiddleware, letting network attackers execute MCP tools with operator's Meta credentials, exploit requires use of streamable-http transport and presence of META_ACCESS_TOKEN.
- 7.2 /10 HighCVE-2026-54544 No auth
Fireshare - Server Side Request Forgery
Fireshare < 1.6.16 contains a server-side request forgery caused by missing @login_required decorator on POST /api/test-discord-webhook and /api/test-webhook endpoints, letting unauthenticated attackers trigger arbitrary HTTP POST requests.
- 9.8 /10 CriticalCVE-2026-54337 PoC publicNo auth
Fireshare - Command Injection
Fireshare < 1.6.14 contains a command injection caused by improper sanitization of arguments in the video upload function, letting unauthenticated attackers write or overwrite system files remotely, exploit requires no authentication.
- 8.2 /10 HighCVE-2026-54167 No auth
Pipelines-as-Code - Authentication Bypass
Pipelines-as-Code < 0.37.8, 0.39.6, 0.42.1, and 0.48.0 contains a broken authentication caused by accepting X-GitHub-Enterprise-Host header before webhook signature validation, letting unauthenticated attackers obtain signed GitHub App JWTs, exploit requires network access to webhook endpoint.
- 7.1 /10 HighCVE-2026-54077 Auth required
ArcadeDB - Server Side Request Forgery & File Read
ArcadeDB prior to 26.6.1 contains a server-side request forgery and file read vulnerability caused by lack of validation in the IMPORT DATABASE statement, letting authenticated users with SQL command access read files or make internal requests, exploit requires authenticated SQL command access.
- 8.1 /10 HighCVE-2026-54076 Auth required
ArcadeDB - Broken Access Control
ArcadeDB prior to 26.6.1 contains a broken access control vulnerability caused by missing authorization checks on schema mutation methods, letting authenticated users without UPDATE_SCHEMA permission alter schema objects, exploit requires authenticated identity.
- 7.7 /10 HighCVE-2026-53957 Auth required
Contentful MCP Server - Authentication Bypass
Contentful MCP Server < 1.7.19 and MCP Tools < 0.4.5 contain an authorization token exposure caused by unvalidated host and proxy options in space migration tools, letting attackers redirect API requests and access tokens, exploit requires enabling migration tools and attacker-controlled content.
- 10.0 /10 CriticalCVE-2026-53710 No auth
MCP Context Forge - Command Injection
MCP Context Forge < 1.0.2 contains a command injection caused by unsafe getattr exposure in python_sandbox_server allowing attackers to execute OS commands via execute_code tool, exploit requires network access to HTTP/SSE transport.
- CriticalCVE-2026-52824 PoC publicNo auth
Kimai - Default APP_SECRET Authentication Bypass
Kimai <= 2.57.0 contains a broken authentication vulnerability caused by a hardcoded default APP_SECRET used to sign login tokens, letting unauthenticated attackers hijack any user account including super-admin.