Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 568 of 677
- 8.8 /10 HighCVE-2026-55416 Auth required
Pimcore - SQL Injection
Pimcore < 11.5.19, 12.3.10, and 2026.1.6 contains an SQL injection caused by improper sanitization of SQL fragments in Custom Reports configuration, letting authenticated users with reports_config permission manipulate database queries, exploit requires authenticated user with reports_config permission.
- 7.7 /10 HighCVE-2026-55253 Auth required
LangChain MongoDB - NoSQL Injection
LangChain MongoDB prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0 contains a NoSQL injection caused by improper filtering of keys prefixed with $ in filter dictionaries, letting authenticated attackers bypass tenant isolation and access other tenants' data, exploit requires authenticated caller controlling filter arguments.
- 9.8 /10 CriticalCVE-2026-55209 No auth
resdata - Buffer Overflow
resdata < 6.2.9 contains a buffer overflow and out-of-bounds read caused by insufficient validation of numeric fields and array indexes in GRDECL file parsing, letting remote attackers cause memory corruption or denial of service, exploit requires untrusted GRDECL file input.
- 7.5 /10 HighCVE-2026-55091 No auth
flat-to-nested - Prototype Pollution
flat-to-nested < 1.1.2 contains a prototype pollution caused by using attacker-controlled id and parent fields as keys in internal objects, letting attackers corrupt application logic or cause denial of service, exploit requires attacker-controlled input to convert().
- 8.5 /10 HighCVE-2026-55072 Auth required
Pimcore - SQL Injection
Pimcore < 2026.1.5 contains an SQL injection caused by incomplete validation of ClassDefinition UID in Block field loading, letting authenticated users with objects permission read or modify database tables.
- 7.5 /10 HighCVE-2026-54632
SIPSorcery - Denial of Service
SIPSorcery < 10.0.9 contains a denial of service caused by insufficient length checks in RTP and STUN attribute parsing, letting remote attackers terminate active RTP or WebRTC sessions by sending malformed packets, exploit requires access to ephemeral RTP/ICE port.
- 7.5 /10 HighCVE-2026-54629 No auth
Anyquery - Information Disclosure
Anyquery < 0.4.5 contains an information disclosure vulnerability caused by unauthenticated access to file-backed SQLite virtual table modules via MySQL-compatible server port, letting remote attackers read files accessible to the server process.
- 8.6 /10 HighCVE-2026-54628 No auth
Anyquery - Server Side Request Forgery
Anyquery < 0.4.5 contains a server-side request forgery caused by exposing URL-capable SQLite virtual table modules via unauthenticated MySQL-compatible port, letting remote attackers access internal network resources, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-54567
Flask-Reuploaded - Unrestricted File Upload
Flask-Reuploaded 1.5.0 to <1.6.0 contains a file upload vulnerability caused by inconsistent extension case handling in UploadSet.save, letting attackers bypass lowercase denylist and upload executable files, exploit requires denylist configuration and user-controlled filename.
- 8.4 /10 HighCVE-2026-54447
GarminConnect - Information Disclosure
GarminConnect < 0.3.5 contains an information disclosure vulnerability caused by insecure file permissions on OAuth token directory and garmin_tokens.json, letting unprivileged users read tokens and access victim's Garmin Connect data, exploit requires shared host environment.
- 9.8 /10 CriticalCVE-2026-54334 No auth
UEFI Firmware Parser - Buffer Overflow
UEFI Firmware Parser < 1.14 contains a buffer overflow caused by improper bounds checking in ReadCLen() during parsing of Tiano or EFI compressed firmware, letting attackers cause heap corruption, crash, or potential code execution, exploit requires crafted firmware input.
- 9.8 /10 CriticalCVE-2026-54333 No auth
UEFI Firmware Parser - Buffer Overflow
UEFI Firmware Parser < 1.14 contains a buffer overflow caused by lack of validation of bit-length values in MakeTable() during Tiano or EFI compressed firmware parsing, letting attackers cause stack corruption and potential code execution, exploit requires crafted firmware bitstream.
- 8.1 /10 HighCVE-2026-54182 No auth
Backpack CRUD - Command Injection
Backpack CRUD < 4.1.70, 5.6.2, 6.8.13, and 7.0.36 contains a command injection caused by unsanitized HTTP Host header used in exec() shell command in Backpack\CRUD\Stats::makeCurlRequest, letting unauthenticated attackers execute OS commands as web-server user, exploit requires reaching a 1-in-100 random gate.
- 7.6 /10 HighCVE-2026-54180 Auth required
Backpack/crud - Broken Access Control
Backpack/crud 6.0.0 to 6.8.14 and 7.0.38 contains a broken access control caused by unscoped model queries in Update, Delete, and Reorder operations, letting authenticated users modify out-of-scope records, exploit requires authentication.
- 8.1 /10 HighCVE-2026-54178 Auth required
Backpack/crud - Broken Access Control
Backpack/crud < 6.8.12 and < 7.0.35 contains an insecure file deletion vulnerability caused by trusting disk-relative paths from clear_<attribute>[] in HasUploadFields::uploadMultipleFilesToDisk, letting authenticated users with Update access delete arbitrary files on the configured disk, exploit requires authenticated Update access.