Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 700 of 767
- 8.3 /10 HighCVE-2026-88024 Auth required
MongoDB Rust Driver - NoSQL Injection
MongoDB Rust Driver contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier, letting authenticated users access or delete unintended stored files, exploit requires authentication.
- 8.3 /10 HighCVE-2026-88023 Auth required
MongoDB PHP Library - NoSQL Injection
MongoDB PHP Library contains a NoSQL injection caused by improper neutralization of special elements in GridFS file identifier handling, letting authenticated users access or modify unintended stored files, exploit requires authentication.
- 7.7 /10 HighCVE-2026-88022 No auth
Laravel MongoDB - NoSQL Injection
Laravel MongoDB integration contains a NoSQL injection caused by improper neutralization of special elements in query logic, letting attackers retrieve or delete unintended documents, exploit requires attacker to supply operator-shaped array.
- 7.1 /10 HighCVE-2026-88021
Consul - Authorization Bypass
Consul and Consul Enterprise contain an authorization bypass caused by improper escaping of characters in service names, namespaces, and partitions in Connect service mesh, letting unauthorized services access restricted destinations, exploit requires crafted service names.
- 9.8 /10 CriticalCVE-2026-88018 No auth
rclone - Authentication Bypass
rclone < 1.75.1 contains an authentication bypass caused by authPairMiddleware registering any client-chosen accessKeyID with an empty secret in s3 serve mode with --auth-proxy but without --auth-key, letting unauthenticated network attackers access backend services, exploit requires no authentication.
- 7.3 /10 HighCVE-2026-88017 Auth required
rclone - Broken Access Control
rclone 1.64.0 to 1.75.1 contains a broken access control vulnerability caused by shared password storage in FTP auth-proxy driver, letting attackers with same username credentials access and modify another session's backend, exploit requires concurrent sessions with same username.
- 7.1 /10 HighCVE-2026-88016 Auth required
rclone - Broken Access Control
rclone < 1.75.1 contains a broken access control caused by symlink handling in backend/local with --links, letting attackers controlling source contents apply ownership, permissions, and timestamps outside destination, exploit requires --metadata flag for chmod and chown.
- 8.1 /10 HighCVE-2026-88011
Traefik - Authentication Bypass
Traefik < 2.11.56 and 3.0.0 to < 3.7.12 contains an identity spoofing vulnerability caused by client-supplied dot-form headers surviving ForwardAuth replacement and underscoreHeadersStrategy, letting attackers spoof identity headers, exploit requires backend normalization of headers.
- 8.2 /10 HighCVE-2026-88009 No auth
Traefik - Authorization Bypass
Traefik < 2.11.57 and < 3.7.13 contains a cross-vhost routing bypass caused by accepting rootless HTTP/1 request targets stored in URL.Opaque but forwarding them verbatim to backend, letting attackers bypass path-scoped authorization and access logging, exploit requires crafted HTTP/1 requests.
- 9.1 /10 CriticalCVE-2026-88008 PoC public
Traefik - Authentication Bypass
Traefik 2.11.26 to 2.11.57 and 3.7.13 contain an authentication bypass caused by forwarding client-supplied Upgrade headers to backends supporting h2c, letting unauthenticated attackers access protected routes, exploit requires backend accepting h2c and returning 101 Switching Protocols.
- 9.1 /10 CriticalCVE-2026-88007
Traefik - Authentication Bypass
Traefik 2.11.0 to 2.11.57 and 3.7.13 contain an authentication bypass caused by shared backend transport usage in HTTP/3 ConnContext, letting attackers reuse authenticated backend connections to impersonate victims, exploit requires HTTP/3 and connection-bound NTLM or Negotiate authentication enabled.
- 7.4 /10 HighCVE-2026-88004 No auth
Traefik - Broken Access Control
Traefik 3.2.0 to 3.7.13 contains a header spoofing vulnerability caused by improper inspection of HTTP trailers in entrypoint defenses, letting unauthenticated clients spoof identity or routing headers via chunked or HTTP/2 trailers.
- 7.7 /10 HighCVE-2026-87993 Auth required
Consul-template - Information Disclosure
Consul-template < 0.43.0 contains an information disclosure vulnerability caused by Vault secret values appearing in template error messages and logs, letting attackers access sensitive information, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-87962 No auth
t-digest - Denial of Service
t-digest 3.1 through 3.3 contains a denial of service caused by lack of validation of length and capacity fields in MergingDigest.fromBytes, letting attackers supply crafted serialized digests to abort parsing thread, exploit requires crafted serialized input.
- 7.1 /10 HighCVE-2026-87961 No auth
ESP32-audioI2S - Out of Bounds Read
ESP32-audioI2S 3.4.4 through 4.0.0 contains a heap-based out-of-bounds read caused by a shadowed length parameter in ID3 synchronized-lyrics processing in read_ID3_Header, letting attackers craft malicious MP3 files or HTTP audio streams to cause crashes or expose adjacent heap memory, exploit requires crafted audio input.