Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 595 of 677
- 7.4 /10 HighCVE-2026-89161 No auth
PCRE2 - Use After Free
PCRE2 < 10.48 contains a use after free caused by mishandling a previously copied subject passed as context in pcre2_jit_match, letting attackers cause memory corruption, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-89147
Net-SNMP - Denial of Service
Net-SNMP through 5.9.5.2 contains a denial of service caused by unauthenticated blocking read without timeout in the SMUX module's smux_accept(), letting unauthenticated remote clients block SNMP processing indefinitely, exploit requires network access to SMUX listener.
- 7.5 /10 HighCVE-2026-89146
libp2p-rendezvous - Denial of Service
libp2p-rendezvous <= 0.17.1 contains a denial of service caused by failure to validate registration TTL values in discovery responses, letting malicious rendezvous servers trigger timer arithmetic overflow and crash client nodes, exploit requires interaction with a malicious server.
- 7.5 /10 HighCVE-2026-89099 Auth required
MongoDB Server - Race Condition
MongoDB Server contains a race condition caused by unsynchronized concurrent operations on internal memory in the document value layer, letting authenticated users with read-write privileges cause memory corruption and server termination, exploit requires authenticated user with read-write access.
- 7.8 /10 HighCVE-2026-89066
projen - Command Injection
projen < 0.103.0 contains a command injection caused by improper neutralization of shell metacharacters in project configuration and repository file names in task synthesis, letting attackers execute arbitrary OS commands, exploit requires crafted project configuration or repository files.
- 7.1 /10 HighCVE-2026-89065
projen - Path Traversal
projen < 0.101.37 contains a path traversal caused by crafted entries in the generated file manifest cleanup component, letting context-dependent attackers recursively delete writable files outside the project directory, exploit requires writable environment.
- 7.7 /10 HighCVE-2026-89060
multicluster-observability-addon - Broken Access Control
multicluster-observability-addon contains a broken access control vulnerability caused by managed-cluster identity referencing configuration resources outside its namespace, letting attacker-controlled managed clusters disclose sensitive hub Secrets, exploit requires attacker-controlled managed cluster.
- 7.5 /10 HighCVE-2026-89013 CISA KEVPoC publicNo auth
Dolibarr - Authorization Bypass
Dolibarr < 24.0.1 contains an authorization bypass caused by crafted 'hashp' parameter in document storage endpoints, letting unauthenticated attackers read arbitrary files including logs and backups, exploit requires crafted 'hashp' parameter.
- 9.8 /10 CriticalCVE-2026-89010 No auth
WAVLINK WN535M1 & WN535M3 - Command Injection
WAVLINK WN535M1 and WN535M3 routers < M35M1_V250922 contain an unauthenticated command injection caused by unsanitized filename input in sync_server daemon on TCP port 13136, letting remote attackers execute arbitrary root commands.
- 9.1 /10 CriticalCVE-2026-89009 No auth
WAVLINK WN535M - Arbitrary File Write
WAVLINK WN535M1 and WN535M3 routers < M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability caused by lack of path canonicalization in sync_server daemon on TCP port 13136, letting remote attackers overwrite files as root, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-87908 No auth
multiparty - Denial of Service
multiparty 2.1.0 < 4.3.1 contains a denial of service caused by unbounded memory usage while accumulating multipart part headers, letting unauthenticated attackers crash the server by sending large header volumes, exploit requires crafted request.
- 9.8 /10 CriticalCVE-2026-8778 No auth
MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields - Unrestricted File Upload
MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin for WordPress <= 1.2.1 contains an unrestricted file upload vulnerability caused by missing file type validation in the mipl_wc_upload_file function, letting unauthenticated attackers upload arbitrary files, potentially leading to remote code execution, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-87776 No auth
compression Node.js - Denial of Service
compression Node.js middleware < 1.8.2 contains a denial of service caused by unreleased zlib streams on client connection abort, letting remote unauthenticated attackers exhaust memory and crash the server, exploit requires repeated early disconnects.
- 8.1 /10 HighCVE-2026-87020 Auth required
Orthanc DICOM Server - Integer Overflow
Orthanc DICOM Server contains an integer overflow caused by improper pitch and buffer-size computation during PNG decoding, letting attackers cause heap out-of-bounds write, exploit requires crafted PNG input.
- 9.8 /10 CriticalCVE-2026-86793 No auth
SGLang - Insecure Deserialization
SGLang contains an insecure deserialization vulnerability caused by unauthenticated pickle deserialization via /update_weights_from_tensor when no auth keys are configured, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication keys configured.