Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 696 of 767
- 7.2 /10 HighCVE-2026-88895 Auth required
CyberPanel - Authentication Bypass
CyberPanel < 3.0.5 contains a broken authentication caused by failure to enforce two-factor authentication on API endpoints, letting attackers with administrator passwords bypass TOTP and perform administrative actions without second factor.
- 7.5 /10 HighCVE-2026-88893 No auth
OpenPanel - Broken Access Control
OpenPanel contains an information disclosure caused by failure to validate access controls in share lookup procedures, letting unauthenticated attackers retrieve password hashes and report definitions via share links, exploit requires share link access.
- 8.3 /10 HighCVE-2026-88891 Auth required
OpenPanel - Broken Access Control
OpenPanel contains a broken access control caused by failure to enforce read-only project access on most mutating procedures, letting attackers with read-only access modify, delete, and publish project data, exploit requires explicit read-only access.
- 8.5 /10 HighCVE-2026-88890 Auth required
OpenPanel - SQL Injection
OpenPanel contains an SQL injection caused by improper validation of profile.* filter column identifiers in the analytics filter builder, letting authenticated attackers with project-scoped read or root export credentials bypass project isolation and access other organizations' analytics data and profile PII.
- 7.8 /10 HighCVE-2026-88889 Auth required
Renovate - Command Injection
Renovate < 44.14.7 contains a command injection caused by unescaped distributionType parameter in maven-wrapper.properties in Maven Wrapper manager, letting attackers execute arbitrary commands remotely during Maven Wrapper updates in binarySource=docker mode.
- 7.0 /10 HighCVE-2026-88888 Auth required
Renovate - Command Injection
Renovate < 44.14.7 contains a command injection caused by unescaped organization parameters in the Mix manager when processing private dependencies, letting attackers execute arbitrary commands as the Renovate user in docker mode.
- 8.6 /10 HighCVE-2026-88887 No auth
Renovate - Information Disclosure
Renovate contains a credential disclosure vulnerability caused by lack of same-origin verification in pagination URL handling for container registries, letting attackers with a malicious registry steal credentials, exploit requires interaction with malicious registry.
- 7.8 /10 HighCVE-2026-88886
Renovate - Command Injection
Renovate < 44.14.7 contains a command injection caused by unescaped distributionUrl in gradle-wrapper module, letting attackers execute arbitrary commands as Renovate user during Gradle Wrapper update, exploit requires self-hosted deployment with specific unsafe execution settings.
- 7.0 /10 HighCVE-2026-88885 Auth required
Renovate - Command Injection
Renovate < 44.14.7 contains a command injection caused by unescaped depName parameters in gomod manager import-path update commands with binarySource=docker, letting attackers execute arbitrary commands as Renovate user during Go module updates, exploit requires postUpdateOptions gomodUpdateImportPaths enabled.
- 7.7 /10 HighCVE-2026-88883
Renovate - Information Disclosure
Renovate before 44.14.4 contains an information disclosure vulnerability caused by incomplete log sanitisation of TLS private keys in Mutual TLS configurations, letting attackers with log access recover private keys, exploit requires access to logs containing unsanitized keys.
- 8.6 /10 HighCVE-2026-88882
Renovate - Information Disclosure
Renovate before 44.11.2 and related Mend Renovate CE/EE images and charts contain an information disclosure vulnerability caused by following pagination URLs in NuGet registry Link headers without origin verification, letting attackers on malicious registries receive registry credentials, exploit requires a malicious or compromised NuGet registry.
- 8.6 /10 HighCVE-2026-88881
Renovate - Information Disclosure
Renovate contains an information disclosure vulnerability caused by unvalidated pagination URLs in the HTTP Link header, letting attackers on compromised GitHub servers obtain credentials, exploit requires a malicious or compromised GitHub server.
- 8.6 /10 HighCVE-2026-88880
Renovate - Open Redirect
Renovate before 44.11.3 contains an open redirect caused by improper validation of Link header destinations when following GitLab server pagination, letting attackers controlling a compromised GitLab server exfiltrate authentication credentials, exploit requires attacker control of GitLab server.
- 8.2 /10 HighCVE-2026-88879 No auth
Traefik - Authentication Bypass
Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11 contain a HTTP header smuggling vulnerability caused by inconsistent header canonicalization, letting remote attackers bypass middleware identity checks, exploit requires crafted headers with dot-form aliases.
- 9.8 /10 CriticalCVE-2026-88877 PoC publicNo auth
Traefik - Authentication Bypass & Broken Access Control
Traefik v3.7.0 to v3.7.11 contains a broken access control vulnerability caused by mishandling of Kubernetes ingress-nginx annotations, letting attackers bypass authentication and other middlewares, exploit requires crafted Host header with non-numeric or empty port.