Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 610 of 677
- 9.1 /10 CriticalCVE-2026-88008 PoC public
Traefik - Authentication Bypass
Traefik 2.11.26 to 2.11.57 and 3.7.13 contain an authentication bypass caused by forwarding client-supplied Upgrade headers to backends supporting h2c, letting unauthenticated attackers access protected routes, exploit requires backend accepting h2c and returning 101 Switching Protocols.
- 9.1 /10 CriticalCVE-2026-88007
Traefik - Authentication Bypass
Traefik 2.11.0 to 2.11.57 and 3.7.13 contain an authentication bypass caused by shared backend transport usage in HTTP/3 ConnContext, letting attackers reuse authenticated backend connections to impersonate victims, exploit requires HTTP/3 and connection-bound NTLM or Negotiate authentication enabled.
- 7.4 /10 HighCVE-2026-88004 No auth
Traefik - Broken Access Control
Traefik 3.2.0 to 3.7.13 contains a header spoofing vulnerability caused by improper inspection of HTTP trailers in entrypoint defenses, letting unauthenticated clients spoof identity or routing headers via chunked or HTTP/2 trailers.
- 7.7 /10 HighCVE-2026-87993 Auth required
Consul-template - Information Disclosure
Consul-template < 0.43.0 contains an information disclosure vulnerability caused by Vault secret values appearing in template error messages and logs, letting attackers access sensitive information, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-87962 No auth
t-digest - Denial of Service
t-digest 3.1 through 3.3 contains a denial of service caused by lack of validation of length and capacity fields in MergingDigest.fromBytes, letting attackers supply crafted serialized digests to abort parsing thread, exploit requires crafted serialized input.
- 7.1 /10 HighCVE-2026-87961 No auth
ESP32-audioI2S - Out of Bounds Read
ESP32-audioI2S 3.4.4 through 4.0.0 contains a heap-based out-of-bounds read caused by a shadowed length parameter in ID3 synchronized-lyrics processing in read_ID3_Header, letting attackers craft malicious MP3 files or HTTP audio streams to cause crashes or expose adjacent heap memory, exploit requires crafted audio input.
- 8.1 /10 HighCVE-2026-87958 Auth required
IBM Db2 - Denial of Service
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 contain a denial of service caused by privileged user disabling specific server functionality, letting privileged attackers disrupt service, exploit requires privileged access.
- 7.3 /10 HighCVE-2026-87933 No auth
DaveGamble cJSON - Use After Free
DaveGamble cJSON <= 1.7.19 contains a use after free vulnerability caused by improper handling in cJSONUtils_MergePatch function in cJSON_Utils.c, letting remote attackers cause memory corruption, exploit requires crafted input.
- 9.6 /10 CriticalCVE-2026-87931 No auth
Behavioral Technology Group Pavlok Behavioral Conditioning Wearable - Buffer Overflow
Behavioral Technology Group Pavlok Behavioral Conditioning Wearable <= 20260707 contains a buffer overflow caused by manipulation in Apple Notification Center Service Event Handler, letting local network attackers cause memory corruption, exploit requires local network access.
- 7.3 /10 HighCVE-2026-87925 No auth
Rizwan17 inventory-management-system - SQL Injection
Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f contains a SQL injection caused by manipulation of the argument pro_name[] in storeCustomerOrderInvoice function in includes/manage.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-87803 Auth required
Countly Server - Authorization Bypass
Countly Server DBViewer contains an authorization bypass caused by flawed sub-pipeline detection in the aggregation stage sanitizer, letting non-admin users with read permission perform unauthorized cross-collection joins and access sensitive data, exploit requires DBViewer read permission.
- 8.3 /10 HighCVE-2026-87090 Auth required
Consul - Authorization Bypass
Consul and Consul Enterprise contain an authorization bypass caused by improper access control in the catalog node-write path, letting authenticated attackers delete other nodes' catalog registrations and take over node identities, exploit requires node-write permission and knowledge of target node ID.
- 7.5 /10 HighCVE-2026-86093
IBM Db2 - Command Injection
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a command injection caused by a stack-based buffer overflow in DRDA server endpoint handling, letting attackers execute arbitrary commands on clients, exploit requires control or impersonation of DRDA server endpoint.
- 7.1 /10 HighCVE-2026-85545 Auth required
HikCentral Access Control - Broken Access Control
HikCentral Access Control contains a broken access control vulnerability caused by authenticated low-privilege users invoking unauthorized API interfaces, letting attackers access restricted functions, exploit requires authenticated low-privilege user.
- 9.1 /10 CriticalCVE-2026-85228 No auth
Amazon Deep Java Library - Integer Overflow
Amazon Deep Java Library (DJL) 0.13.0 through 0.36.0 contains an integer overflow caused by improper tensor buffer validation, letting remote unauthenticated actors cause denial of service or information disclosure via crafted tensor payloads.