Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 632 of 677

  • 8.1 /10 High
    CVE-2026-73334

    Apache Parquet - Information Disclosure

    Apache Parquet 1.12 to 1.18 contains a potential information disclosure caused by lack of host validation in pluggable KmsClient implementations when using file-controlled KMS URLs, letting attackers receive KMS tokens, exploit requires use of file-controlled KMS URL without application control.

  • 8.1 /10 High
    CVE-2026-71809 No auth

    Siam Ordering - Authentication Bypass

    Siam Ordering (siam-server) 1.0.0 contains an authentication bypass caused by a hardcoded master verification code, letting remote unauthenticated attackers log in as any user, merchant, or administrator, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-71808 Auth required

    Siam Ordering - SQL Injection

    Siam Ordering (siam-server) 1.0.0 contains a SQL injection caused by unsanitized ${} string concatenation in AdminMapper.java and other Mapper files, letting remote authenticated attackers execute arbitrary SQL commands.

  • 9.8 /10 Critical
    CVE-2026-71805 No auth

    LZ-litchi - Unrestricted File Upload

    LZ-litchi 1.0.0 contains an unrestricted file upload and path traversal vulnerability caused by improper validation of the directory parameter in POST /app-api/infra/file/upload, letting unauthenticated remote attackers upload and write arbitrary files outside intended directories.

  • 9.8 /10 Critical
    CVE-2026-71801 No auth

    s-pms SPMS-Server - Authentication Bypass

    s-pms SPMS-Server through v1.0 contains a broken authentication caused by a hardcoded default access token secret in the core configuration file, letting remote unauthenticated attackers bypass authentication and gain full admin access, exploit requires no special conditions.

  • 8.4 /10 High
    CVE-2026-71614 No auth

    GPAC - Remote Code Execution

    GPAC contains a remote code execution caused by flaws in src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identifier(), and gf_m2ts_ipdatagram_reader() components, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.8 /10 High
    CVE-2026-71613 No auth

    GPAC - Buffer Overflow

    GPAC contains a buffer overflow caused by improper handling in the j2kdec_process() function, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.4 /10 High
    CVE-2026-71612 No auth

    GPAC - Buffer Overflow

    GPAC contains a buffer overflow caused by improper handling in the nhntdmx_process() function, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-67401 PoC publicAuth required

    cPanel - SQL Injection

    cPanel contains a SQL injection caused by improper input sanitization in the EmailTrack component, letting mail-enabled accounts achieve remote code execution as root, exploit requires mail-enabled account access.

  • 8.1 /10 High
    CVE-2026-65181 Auth required

    Impala - Remote Code Execution

    Impala 2.7-4.5 contains a remote code execution caused by insufficient authorization of Data Source tables, letting clients with upload privileges execute arbitrary Java code remotely, exploit requires upload privileges.

  • 8.2 /10 High
    CVE-2026-6485

    UEFI BIOS - Authentication Bypass

    UEFI BIOS embedded Shell contains a Secure Boot bypass caused by shell commands or startup scripts, letting attackers bypass Secure Boot protections, exploit requires access to the embedded shell.

  • 8.8 /10 High
    CVE-2026-57866 Auth required

    Apache Impala - Server Side Request Forgery

    Apache Impala 4.4.x and 4.5.x contain a server side request forgery caused by improper access control in ai_generate_text() function, letting authenticated users exfiltrate secrets from credential providers, exploit requires known secret keys.

  • 7.0 /10 High
    CVE-2026-56711 No auth

    VLC media player - Integer Overflow

    VLC media player contains an integer overflow in AllocatePicture due to 32-bit arithmetic on picture buffer size calculation, letting remote attackers cause out-of-bounds write via crafted PNG with large dimensions, exploit requires opening the file.

  • 9.8 /10 Critical
    CVE-2026-56207

    Apache Impala - Authentication Bypass

    Apache Impala >=4.0.0 contains a broken authentication caused by lack of signature verification of Bearer token in the last step of SAML2 authentication for hs2-http interface, letting attackers alter user names and impersonate other users, exploit requires crafted Bearer token.

  • 9.6 /10 Critical
    CVE-2026-54694 No auth

    SkillTree - Stored XSS & CSRF Token Theft

    SkillTree < 4.4.2 contains a stored XSS caused by unsanitized user input in account registration fields and unsafe HTML rendering in StringHighlighter.js and HighlightedValue.vue, letting attackers execute arbitrary scripts in admin browsers, exploit requires attacker to self-register with crafted input.