Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 628 of 677
- 8.5 /10 HighCVE-2026-87030 Auth required
Tanium Comply - Path Traversal
Tanium Comply contains a path traversal vulnerability, letting attackers access unauthorized files, exploit requires no special privileges.
- 8.5 /10 HighCVE-2026-87023 Auth required
Tanium Comply - Path Traversal
Tanium Comply contains a path traversal vulnerability, letting attackers access unauthorized file paths, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-87021
Tanium Comply - Remote Code Execution
Tanium Comply contains an unauthorized code execution vulnerability, letting attackers execute code without proper authorization, exploit requires unspecified conditions.
- 8.1 /10 HighCVE-2026-87016 PoC publicNo auth
Open WebUI - Authentication Bypass
Open WebUI 0.6.41 to 0.11.1 contains an authentication bypass caused by improper JSON matching compiled to SQL LIKE on SQLite, letting attackers impersonate administrator accounts, exploit requires crafted OAuth subject with wildcard characters.
- 7.5 /10 HighCVE-2026-87011 PoC public
Open WebUI - Denial of Service
Open WebUI 0.9.0 to 0.11.1 contains a denial of service caused by uncached network fetches and blocking signing-key lookup in the unauthenticated POST /oauth/backchannel-logout handler, letting remote attackers stall the single-worker instance and amplify traffic, exploit requires ENABLE_OAUTH_BACKCHANNEL_LOGOUT enabled.
- 8.6 /10 HighCVE-2026-86775 No auth
knowns - Path Traversal
knowns (npm package) <= 0.29.1 contains a path traversal vulnerability caused by improper sanitization of document paths in the Document API, letting remote unauthenticated attackers read, write, or delete arbitrary .md files, exploit requires unauthenticated access to Management API.
- 7.6 /10 HighCVE-2026-86771 PoC publicAuth required
Snipe-IT - Server Side Request Forgery
Snipe-IT < 8.7.0 contains a server-side request forgery caused by unescaped employee_num field in the acceptance PDF generator, letting attackers with users.edit permission trigger server-side HTTP requests, exploit requires users.edit permission.
- 8.1 /10 HighCVE-2026-86770 PoC publicAuth required
Snipe-IT - Authentication Bypass
Snipe-IT < 8.7.0 contains a broken authentication caused by failure to validate username case sensitivity during SAML authentication, letting attackers bypass username matching and achieve account takeover via federated login paths, exploit requires attacker to register IdP accounts with accent or case variants of victim usernames.
- 8.1 /10 HighCVE-2026-86762 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT < 8.7.0 contains a broken access control caused by missing CheckUserIsActivated middleware in the API group and non-revocation of personal access tokens, letting attackers with deactivated accounts maintain API access and re-activate themselves.
- 7.1 /10 HighCVE-2026-86759 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT < 8.7.0 contains a broken access control caused by failure to authorize POST /hardware/history endpoint, letting authenticated users reassign assets and modify audit logs, exploit requires user authentication.
- 7.3 /10 HighCVE-2026-86754 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT < 8.7.0 contains a broken access control vulnerability caused by improper gating of Laravel Passport OAuth client management routes, letting authenticated users register OAuth clients with attacker-controlled redirect URIs, exploit requires user authentication.
- 8.5 /10 HighCVE-2026-86751 PoC publicAuth required
Snipe-IT - Server-Side Request Forgery & Information Disclosure
Snipe-IT < 8.7.0 contains a server-side request forgery and file read vulnerability caused by improper sanitization of markdown image syntax in note fields, letting authenticated users read arbitrary server files and issue HTTP requests.
- 7.7 /10 HighCVE-2026-86750 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT <= 8.6.3 contains a broken access control caused by improper validation of company assignment authorization in user record persistence via REST API, letting non-superuser attackers create or relocate user accounts across tenant boundaries, exploit requires Full Multiple Companies Support enabled and specific permissions.
- 8.5 /10 HighCVE-2026-86741 PoC publicAuth required
Snipe-IT - Server Side Request Forgery
Snipe-IT < 8.7.0 contains a server-side request forgery caused by unsanitized category EULA text field rendering in checkout confirmation emails, letting low-privilege attackers exfiltrate sensitive files and perform SSRF.
- 7.5 /10 HighCVE-2026-86201 No auth
PocketMine-MP - Denial of Service
PocketMine-MP < 5.41.1 contains a denial of service caused by unsanitized large or complex structures in unknown clientData JWT properties during LoginPacket processing, letting attackers crash the server by triggering out-of-memory conditions, exploit requires sending crafted LoginPackets.