Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 569 of 677
- 7.6 /10 HighCVE-2026-54175 Auth required
Backpack CRUD - Broken Access Control
Backpack CRUD < 6.8.11 and < 7.0.34 contains a broken access control caused by improper mass assignment in MyAccountController::postAccountInfoForm, letting authenticated attackers escalate privileges or take over accounts via crafted requests.
- 7.5 /10 HighCVE-2026-54156 No auth
node-opcua - Denial of Service
node-opcua prior to 2.166.0 contains a denial of service caused by unbounded nonce cache growth in server_secure_channel_layer.ts, letting unauthenticated remote attackers exhaust server memory, exploit requires repeated session creation with unique nonces.
- 7.7 /10 HighCVE-2026-54155
node-opcua - Authentication Bypass
node-opcua < 2.166.0 contains a broken authentication caused by improper verification of RSA-OAEP password blob and missing nonce binding in UserNameIdentityToken handler, letting unauthenticated remote attackers compromise accounts and replay tokens, exploit requires attacker to obtain server public key.
- 7.6 /10 HighCVE-2026-54087 Auth required
EasyAdmin - Stored XSS & Privilege Escalation
EasyAdmin 5.0.0 to 5.0.13 contains a stored XSS caused by browser-executable file uploads in FileField and ImageField without proper Content-Disposition headers, letting attackers execute JavaScript in authenticated admin's origin, exploit requires privilege gap between uploader and viewer.
- 7.5 /10 HighCVE-2026-53752 No auth
docx4j - Denial of Service
docx4j prior to 11.5.14 contains a denial of service caused by unbounded recursion in PropertyResolver due to cyclic w:basedOn style inheritance, letting attackers terminate worker threads, exploit requires processing untrusted DOCX files.
- 7.4 /10 HighCVE-2026-53714 No auth
Envoy Gateway - Authentication Bypass
Envoy Gateway < 1.7.4 and < 1.8.1 contains an authentication bypass caused by missing UnaryInterceptor and incomplete JWT validation in xDS gRPC server, letting attackers with network access retrieve sensitive configuration and TLS keys, exploit requires network access to port 18000.
- 9.1 /10 CriticalCVE-2026-53713 Auth required
Envoy Gateway - Path Traversal
Envoy Gateway < 1.7.4 and < 1.8.1 contains a file system read caused by improper path normalization in to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua, letting attackers read arbitrary files from the gateway controller pod, exploit requires submission of Lua code through EnvoyExtensionPolicy.
- 7.5 /10 HighCVE-2026-53659 No auth
http4k - Denial of Service
http4k < 4.51.0.0, 5.42.0.0, and 6.49.0.0 contain a denial of service caused by unlimited gzip decompression size in ServerFilters.GZip and RequestFilters.GunZip, letting unauthenticated clients exhaust JVM heap, exploit requires sending crafted gzip request.
- 7.5 /10 HighCVE-2026-50276 No auth
Datadog dd-trace-rb - Denial of Service
Datadog dd-trace-rb < 2.32.0 contains a denial of service caused by lack of enforcement of baggage size limits during W3C baggage extraction, letting remote unauthenticated attackers cause unbounded CPU and memory consumption, exploit requires sending crafted baggage HTTP headers.
- 7.5 /10 HighCVE-2026-50270 No auth
Datadog dd-trace-java - Denial of Service
Datadog dd-trace-java < 1.62.0 contains a denial of service caused by lack of enforcement of baggage size limits during W3C baggage extraction, letting remote unauthenticated attackers cause unbounded CPU and memory consumption, exploit requires sending crafted baggage HTTP headers.
- 9.1 /10 CriticalCVE-2026-50006 No auth
Anyquery - SQL Injection
Anyquery < 0.4.5 contains an unrestricted ATTACH DATABASE vulnerability in its MySQL-compatible server port, letting remote attackers create or overwrite arbitrary files, causing filesystem integrity loss and denial of service, exploit requires network access.
- 7.7 /10 HighCVE-2026-47701 Auth required
OpenTelemetry Operator - Information Disclosure
OpenTelemetry Operator < 0.152.0 contains an information disclosure caused by improper handling of ServiceMonitor bearerTokenFile in TargetAllocator, letting tenants with ServiceMonitor creation/update permissions disclose Collector service-account tokens, exploit requires Collector service-account token or sensitive file mounted and network access to target endpoint.
- 7.3 /10 HighCVE-2026-47253 Auth required
Anyquery - Path Traversal
Anyquery < 0.4.5 contains a path traversal caused by insufficient validation of the plugin parameter in clear_plugin_cache function, letting low-privileged bearer-token holders delete arbitrary writable directories, exploit requires bearer-token authentication.
- 8.8 /10 HighCVE-2026-43815
Apple macOS - Buffer Overflow
Apple macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6 contain a buffer overflow caused by insufficient bounds checking in AFPFS connection, letting attackers cause kernel memory corruption by connecting to a malicious AFPFS server, exploit requires attacker to control AFPFS server.
- 9.1 /10 CriticalCVE-2026-43790 No auth
Apple macOS - Denial of Service
Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a memory corruption vulnerability caused by improper memory handling, letting remote attackers cause system termination or kernel memory corruption, exploit requires network access.