Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 620 of 677
- 9.8 /10 CriticalCVE-2026-87929 No auth
MaxSite CMS - Authentication Bypass
MaxSite CMS through 109.6 contains a broken authentication caused by a hardcoded session encryption key in application/config/config.php, letting unauthenticated attackers forge administrator session cookies, exploit requires knowledge of the hardcoded key.
- 8.2 /10 HighCVE-2026-87927 No auth
MaxSite CMS - Local File Inclusion
MaxSite CMS <= 109.6 contains a local file inclusion vulnerability caused by base64-encoded path traversal sequences in ajax and require-maxsite dispatchers, letting unauthenticated attackers execute privileged handler files bypassing path validation.
- 7.3 /10 HighCVE-2026-87922 No auth
Rizwan17 inventory-management-system - Authentication Bypass
Rizwan17 inventory-management-system contains an authentication bypass caused by manipulation of the "userid" argument in DBOperation.addCategory of includes/process.php AJAX Backend, letting remote attackers bypass authentication, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-87921 No auth
Rizwan17 inventory-management-system - SQL Injection
Rizwan17 inventory-management-system contains a SQL injection caused by manipulation of update_category, cid, update_brand, or update_product arguments in includes/manage.php update_record function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 9.6 /10 CriticalCVE-2026-87911 No auth
Amazon awslabs postgres-mcp-server - Command Injection
Amazon awslabs postgres-mcp-server < 1.1.7 contains an OS command injection caused by improper read-only enforcement in the SQL validation component, letting unauthenticated actors execute OS commands via crafted COPY ... TO PROGRAM statements, exploit requires authenticated user interaction.
- 7.7 /10 HighCVE-2026-87877 No auth
zstd-jni - Use After Free
zstd-jni < 1.5.7-14 contains a use-after-free caused by failure to validate closed state in setDict, setLongMax, setLevel, and setRefMultipleDDicts methods, letting attackers corrupt memory or crash JVM by writing through freed pointers.
- 8.1 /10 HighCVE-2026-87874
community.general Ansible - Remote Code Execution
community.general Ansible collection memcached cache plugin contains an insecure deserialization vulnerability caused by unprotected pickle deserialization in python-memcached, letting remote attackers execute arbitrary code via crafted payloads on the Ansible controller, exploit requires network access to memcached instance.
- 7.5 /10 HighCVE-2026-87853
SSSD - Authentication Bypass
SSSD contains an authentication bypass caused by prefix comparison of OIDC subject identifiers in eval_access_token_buf(), letting attackers authenticate as other users with prefix IdP identifiers, exploit requires attacker to control IdP identifier.
- 7.7 /10 HighCVE-2026-87825 No auth
zstd-jni - Use After Free
zstd-jni < 1.5.7-14 contains a use-after-free vulnerability caused by dictionary shared lock being held only during load call, letting attackers cause silent data corruption or JVM crashes by closing dictionary while referenced.
- 7.5 /10 HighCVE-2026-87824 No auth
zstd-jni - Denial of Service
zstd-jni before 1.5.7-14 contains an out-of-bounds read caused by improper validation of samples buffer capacity in Zstd.trainFromBufferDirect, letting attackers cause JVM termination by supplying crafted sample lengths, exploit requires crafted input.
- 8.2 /10 HighCVE-2026-87823 No auth
zstd-jni - Out of Bounds Read
zstd-jni before 1.5.7-14 contains a buffer overflow caused by 32-bit signed bounds checks on direct-ByteBuffer frame-size native methods, letting attackers read out-of-bounds memory, exploit requires crafted input with negative or overflowing offsets.
- 7.5 /10 HighCVE-2026-87822 No auth
t-digest - Denial of Service
t-digest 3.1 through 3.3 contains a denial of service caused by failure to validate centroid means during deserialization in MergingDigest.fromBytes, letting attackers inject NaN values that degrade sorting performance, exploit requires crafted serialized digests.
- 7.1 /10 HighCVE-2026-87821 Auth required
Lara Dashboard - Server-Side Request Forgery
Lara Dashboard <= 1.3.1 contains a server-side request forgery caused by lack of host validation and redirect restrictions in POST /api/admin/builder/markdown/fetch, letting authenticated users fetch arbitrary URLs and read responses.
- 7.5 /10 HighCVE-2026-87819 PoC publicNo auth
GitPython - Denial of Service
GitPython < 3.1.60 contains a regular expression denial of service caused by malformed author field processing in Actor.name_email_regex, letting attackers exhaust CPU resources, exploit requires crafted commit object.
- 8.8 /10 HighCVE-2026-87817 PoC publicNo auth
GitPython - Remote Code Execution
GitPython < 3.1.60 contains a code execution vulnerability caused by improper validation of git directory location using tracked files like gitdir, commondir, and HEAD, letting attackers execute arbitrary code when victims call index.commit() on cloned or opened repositories.