Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 556 of 677

  • 7.3 /10 High
    CVE-2026-90819 No auth

    a2aproject a2a-java - HTTP Response Splitting

    a2aproject a2a-java 1.2.0 contains an HTTP response splitting vulnerability caused by improper Authorization Header Construction in BasePushNotificationSender.dispatchNotification, letting remote attackers manipulate HTTP responses, exploit requires crafted requests.

  • 7.3 /10 High
    CVE-2026-90809 No auth

    HKUDS nanobot - Command Injection

    HKUDS nanobot <= 0.2.1 contains a command injection caused by improper handling in ExecTool._guard_command and ExecTool._spawn in nanobot/agent/tools/shell.py, letting remote attackers inject arguments, exploit requires remote access.

  • 7.3 /10 High
    CVE-2026-90805 No auth

    subhajitkhan online-clinic-management-system - SQL Injection

    subhajitkhan online-clinic-management-system contains a SQL injection caused by manipulation of the doc_mail/doc_pswd arguments in doctorlogin.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90789 No auth

    itsourcecode Leave Management System - SQL Injection

    itsourcecode Leave Management System 1.0 contains a sql injection caused by manipulation of the "user_email" argument in /login.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-90787 No auth

    Soarkey StudentManagement - Broken Access Control

    Soarkey StudentManagement contains an improper privilege management vulnerability caused by manipulation of the "level" argument in RegisterServlet.doPost of Registration Workflow, letting remote attackers escalate privileges, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-90715 No auth

    marcobambini Gravity - Integer Overflow

    marcobambini Gravity <= 0.9.7 contains an integer overflow caused by improper handling in udp json-parser component in src/utils/gravity_json.c, letting remote attackers cause potential memory corruption, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-90710 No auth

    taisan tarzan-cms - Server-Side Request Forgery

    taisan tarzan-cms 1.0.0 contains a server-side request forgery caused by manipulation of the "httpUrl" argument in Theme Download Function, letting remote attackers make arbitrary server requests, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90708 No auth

    Yot CMS - SQL Injection

    Yot CMS <= 3.3.1 contains a SQL injection caused by manipulation of the yot3_user/yot3_pass arguments in the Login function of global.php Cookie Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 8.3 /10 High
    CVE-2026-90707 No auth

    Open5GS - Use After Free

    Open5GS <= 2.7.x contains a use after free vulnerability caused by manipulation of the discovery_option argument in amf_nnrf_try_old_amf_discovery_fallback function, letting remote attackers cause memory corruption, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-90703 Auth required

    D-Link DWR-M921 - Command Injection

    D-Link DWR-M921 1.1.52 contains a command injection caused by manipulation of the "folderpath" argument in /boafrm/formDiskCreateShare system function, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-90702 Auth required

    D-Link DWR-M921 - Command Injection

    D-Link DWR-M921 1.1.52 contains a command injection caused by manipulation of the "partition" argument in /boafrm/formDiskFormat, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90701 No auth

    subhajitkhan online-clinic-management-system - SQL Injection

    subhajitkhan online-clinic-management-system contains a SQL injection caused by manipulation of the "searchtext" argument in listdoctor.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-90699 Auth required

    D-Link DWR-M920 - Command Injection

    D-Link DWR-M920 1.1.7 contains a command injection caused by manipulation of the "newPin" argument in /boafrm/formPinManageSetup, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-90693 Auth required

    D-Link DIR-878 - Buffer Overflow

    D-Link DIR-878 120B05 contains a stack-based buffer overflow caused by manipulation of the Primary/Secondary argument in SetWan3Settings of WAN Settings, letting remote attackers execute arbitrary code, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-90692 Auth required

    D-Link DIR-878 - Buffer Overflow

    D-Link DIR-878 120B05 contains a stack-based buffer overflow caused by manipulation of the IPv6Address/Hostname argument in SetDynamicDNSIPv6Settings, letting remote attackers execute arbitrary code, exploit requires crafted request.