Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 609 of 677

  • 8.3 /10 High
    CVE-2026-88033 Auth required

    MongoDB Java Driver - NoSQL Injection

    MongoDB Java Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users access or modify unintended stored files, exploit requires authentication.

  • 8.1 /10 High
    CVE-2026-88031 Auth required

    MongoDB Go Driver - NoSQL Injection

    MongoDB Go Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users delete all GridFS file chunks, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88030 Auth required

    MongoDB Ruby Driver - NoSQL Injection

    MongoDB Ruby Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifiers, letting authenticated users access or delete unintended stored file content, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88029 Auth required

    MongoDB Python Driver - NoSQL Injection

    MongoDB Python Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier handling, letting authenticated users access or modify unintended stored files, exploit requires authentication.

  • 7.1 /10 High
    CVE-2026-88027 Auth required

    Laravel MongoDB - NoSQL Injection

    Laravel MongoDB integration contains a NoSQL injection caused by improper neutralization of special elements in embedded-document relation handling, letting authenticated users delete or overwrite embedded documents, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88025 Auth required

    MongoDB C# Driver - NoSQL Injection

    MongoDB C# Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users access or modify unintended stored files, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88024 Auth required

    MongoDB Rust Driver - NoSQL Injection

    MongoDB Rust Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users access or delete unintended stored files, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-88023 Auth required

    MongoDB PHP Library - NoSQL Injection

    MongoDB PHP Library contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier handling, letting authenticated users access or modify unintended stored files, exploit requires authentication.

  • 7.7 /10 High
    CVE-2026-88022 No auth

    Laravel MongoDB - NoSQL Injection

    Laravel MongoDB integration contains a NoSQL injection caused by improper neutralization of special elements in query logic, letting attackers retrieve or delete unintended documents, exploit requires attacker to supply operator-shaped array.

  • 7.1 /10 High
    CVE-2026-88021

    Consul - Authorization Bypass

    Consul and Consul Enterprise contain an authorization bypass caused by improper escaping of characters in service names, namespaces, and partitions in Connect service mesh, letting unauthorized services access restricted destinations, exploit requires crafted service names.

  • 9.8 /10 Critical
    CVE-2026-88018 No auth

    rclone - Authentication Bypass

    rclone < 1.75.1 contains an authentication bypass caused by authPairMiddleware registering any client-chosen accessKeyID with an empty secret in s3 serve mode with --auth-proxy but without --auth-key, letting unauthenticated network attackers access backend services, exploit requires no authentication.

  • 7.3 /10 High
    CVE-2026-88017 Auth required

    rclone - Broken Access Control

    rclone 1.64.0 to 1.75.1 contains a broken access control vulnerability caused by shared password storage in FTP auth-proxy driver, letting attackers with same username credentials access and modify another session's backend, exploit requires concurrent sessions with same username.

  • 7.1 /10 High
    CVE-2026-88016 Auth required

    rclone - Broken Access Control

    rclone < 1.75.1 contains a broken access control caused by symlink handling in backend/local with --links, letting attackers controlling source contents apply ownership, permissions, and timestamps outside destination, exploit requires --metadata flag for chmod and chown.

  • 8.1 /10 High
    CVE-2026-88011

    Traefik - Authentication Bypass

    Traefik < 2.11.56 and 3.0.0 to < 3.7.12 contains an identity spoofing vulnerability caused by client-supplied dot-form headers surviving ForwardAuth replacement and underscoreHeadersStrategy, letting attackers spoof identity headers, exploit requires backend normalization of headers.

  • 8.2 /10 High
    CVE-2026-88009 No auth

    Traefik - Authorization Bypass

    Traefik < 2.11.57 and < 3.7.13 contains a cross-vhost routing bypass caused by accepting rootless HTTP/1 request targets stored in URL.Opaque but forwarding them verbatim to backend, letting attackers bypass path-scoped authorization and access logging, exploit requires crafted HTTP/1 requests.