Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 621 of 677

  • 7.5 /10 High
    CVE-2026-87816 No auth

    PasswordPusher - Race Condition

    PasswordPusher < 2.11.1 contains a race condition in view limit enforcement, letting unauthenticated attackers bypass expire_after_views limits by sending concurrent requests to the show endpoint.

  • 8.7 /10 High
    CVE-2026-87815 Auth required

    SiYuan - Path Traversal

    SiYuan < v3.8.2 contains a path traversal caused by improper validation of the deckID parameter in /api/riff/removeRiffDeck, letting authenticated administrators delete arbitrary .deck and .cards files outside the workspace directory.

  • 7.3 /10 High
    CVE-2026-87814 Auth required

    SiYuan - Stored XSS

    SiYuan < 3.8.2 contains a stored cross-site scripting vulnerability caused by failure to escape indexed asset content in the search asset preview feature, letting attackers execute JavaScript in the SiYuan origin, exploit requires attacker to place crafted text assets in a workspace.

  • 7.3 /10 High
    CVE-2026-87813 Auth required

    SiYuan - Stored XSS

    SiYuan < 3.8.2 contains a stored XSS caused by unescaped asset filenames in Search Assets result list, letting authenticated attackers execute JavaScript in victim browsers, exploit requires authentication.

  • 7.3 /10 High
    CVE-2026-87811 Auth required

    SiYuan - Stored XSS

    SiYuan < 3.8.2 contains a stored XSS caused by improper attribute encoding of persisted notebook template paths in HTML input value attributes, letting attackers execute JavaScript when victims open notebook configuration, exploit requires crafted malicious template paths.

  • 7.5 /10 High
    CVE-2026-87807 No auth

    Siyuan - SQL Injection

    Siyuan < v3.8.2 contains an authenticated SQL injection caused by improper sanitization of the method=1 query parameter in fullTextSearchBlock endpoint, letting authenticated attackers read sensitive document content by bypassing access controls.

  • 7.4 /10 High
    CVE-2026-87806 No auth

    Parse Server - Authentication Bypass

    Parse Server <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass caused by improper handling of zero-length passwords in the LDAP authentication adapter, letting unauthenticated attackers obtain valid session tokens, exploit requires LDAP authentication adapter enabled and directory allowing unauthenticated simple bind.

  • 8.2 /10 High
    CVE-2026-87795 No auth

    zstd-jni - Out of Bounds Read

    zstd-jni < 1.5.7-14 contains an out-of-bounds read caused by improper validation of offset and length parameters in ZstdDictCompress constructor, letting attackers read native heap memory, exploit requires supplying untrusted offset or length values.

  • 8.4 /10 High
    CVE-2026-87794 No auth

    bestzip - Command Injection

    bestzip 2.2.6 and 3.0.2 contain a command injection caused by argument injection in the nativeZip function, letting attackers execute arbitrary commands with Node.js process privileges, exploit requires crafted source entries and malicious destination path.

  • 8.8 /10 High
    CVE-2026-87766 Auth required

    bubblewrap - Path Traversal

    bubblewrap before 0.12.0 contains a path traversal caused by following parent symlinks via /oldroot during sandbox setup, letting attackers write files outside the sandbox as the launching user, exploit requires sandbox setup.

  • 7.5 /10 High
    CVE-2026-87734 No auth

    utcp - Denial of Service

    utcp < 0.0.6 for OCaml contains a denial of service caused by out-of-order segment reassembly, letting remote attackers cause service disruption, exploit requires network access.

  • 9.6 /10 Critical
    CVE-2026-87654 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 153.0.8010.36 contains a buffer overflow in ANGLE on Windows, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-87650 No auth

    Google Chrome - Out of Bounds Read

    Google Chrome < 153.0.8010.36 contains an out of bounds read in WebGL, letting remote attackers potentially execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-87648

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 on Windows contains a use after free vulnerability in ANGLE, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 9.6 /10 Critical
    CVE-2026-87646 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Web Authentication, caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.