Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 719 of 767
- 7.6 /10 HighCVE-2026-86771 PoC publicAuth required
Snipe-IT - Server Side Request Forgery
Snipe-IT < 8.7.0 contains a server-side request forgery caused by unescaped employee_num field in the acceptance PDF generator, letting attackers with users.edit permission trigger server-side HTTP requests, exploit requires users.edit permission.
- 8.1 /10 HighCVE-2026-86770 PoC publicAuth required
Snipe-IT - Authentication Bypass
Snipe-IT < 8.7.0 contains a broken authentication caused by failure to validate username case sensitivity during SAML authentication, letting attackers bypass username matching and achieve account takeover via federated login paths, exploit requires attacker to register IdP accounts with accent or case variants of victim usernames.
- 8.1 /10 HighCVE-2026-86762 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT < 8.7.0 contains a broken access control caused by missing CheckUserIsActivated middleware in the API group and non-revocation of personal access tokens, letting attackers with deactivated accounts maintain API access and re-activate themselves.
- 7.1 /10 HighCVE-2026-86759 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT < 8.7.0 contains a broken access control caused by failure to authorize POST /hardware/history endpoint, letting authenticated users reassign assets and modify audit logs, exploit requires user authentication.
- 7.3 /10 HighCVE-2026-86754 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT < 8.7.0 contains a broken access control vulnerability caused by improper gating of Laravel Passport OAuth client management routes, letting authenticated users register OAuth clients with attacker-controlled redirect URIs, exploit requires user authentication.
- 8.5 /10 HighCVE-2026-86751 PoC publicAuth required
Snipe-IT - Server-Side Request Forgery & Information Disclosure
Snipe-IT < 8.7.0 contains a server-side request forgery and file read vulnerability caused by improper sanitization of markdown image syntax in note fields, letting authenticated users read arbitrary server files and issue HTTP requests.
- 7.7 /10 HighCVE-2026-86750 PoC publicAuth required
Snipe-IT - Broken Access Control
Snipe-IT <= 8.6.3 contains a broken access control caused by improper validation of company assignment authorization in user record persistence via REST API, letting non-superuser attackers create or relocate user accounts across tenant boundaries, exploit requires Full Multiple Companies Support enabled and specific permissions.
- 8.5 /10 HighCVE-2026-86741 PoC publicAuth required
Snipe-IT - Server Side Request Forgery
Snipe-IT < 8.7.0 contains a server-side request forgery caused by unsanitized category EULA text field rendering in checkout confirmation emails, letting low-privilege attackers exfiltrate sensitive files and perform SSRF.
- 7.5 /10 HighCVE-2026-86201 No auth
PocketMine-MP - Denial of Service
PocketMine-MP < 5.41.1 contains a denial of service caused by unsanitized large or complex structures in unknown clientData JWT properties during LoginPacket processing, letting attackers crash the server by triggering out-of-memory conditions, exploit requires sending crafted LoginPackets.
- 7.5 /10 HighCVE-2026-86199 No auth
PocketMine-MP - Denial of Service
PocketMine-MP < 5.43.1 contains a denial of service caused by improper validation of the Certificate field during offline login authentication, letting unauthenticated players crash the server by triggering an uninitialized property access error.
- 8.2 /10 HighCVE-2026-86099 No auth
Chainlit - Path Traversal
Chainlit through 2.12.0 contains a path traversal caused by improper validation of client-supplied socket.io sessionId parameter, letting unauthenticated attackers delete arbitrary directories, exploit requires crafted sessionId values.
- 9.8 /10 CriticalCVE-2026-85978 No auth
Akana API Platform - Remote Code Execution
Akana API Platform contains a remote code execution caused by path normalization discrepancy in the Policy Manager console, letting unauthenticated remote attackers execute arbitrary code, exploit requires no authentication or user interaction.
- 9.8 /10 CriticalCVE-2026-85103 No auth
Check Point Quantum Security Management & Quantum Security Gateway - Remote Code Execution
Check Point Quantum Security Management and Quantum Security Gateway contain a heap-based buffer overflow caused by improper ASN.1 decoding in VPN certificate processing, letting unauthenticated remote attackers execute arbitrary code.
- 9.8 /10 CriticalCVE-2026-85102 CISA KEVPoC publicNo auth
Check Point Quantum Security Gateway - Remote Code Execution
Check Point Quantum Security Gateway contains a remote code execution caused by improper certificate trust validation during VPN negotiation, letting unauthenticated remote attackers execute arbitrary code.
- 7.2 /10 HighCVE-2026-84293 No auth
Gravity Forms Repeater Fields - Stored XSS
Gravity Forms Repeater Fields plugin for WordPress <= 3.0.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in repeated multi-input sub-field values, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires multi-input sub-field usage.