Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 726 of 767

  • 8.2 /10 High
    CVE-2026-12855 Auth required

    HP Projects - Buffer Overflow

    HP projects contain a buffer overflow caused by unvalidated memory boundaries in custom code, letting attackers execute arbitrary code remotely, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2024-58382 No auth

    league/commonmark - Denial of Service

    league/commonmark < 2.6.0 contains a denial of service caused by polynomial time complexity in Markdown parsing, letting attackers exhaust CPU and PHP-FPM resources, exploit requires crafted Markdown inputs.

  • 7.5 /10 High
    CVE-2024-58381 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 5.11.1 contains a denial of service vulnerability caused by improper object initialization from scalar JSON types in LoginPacket JSON processing, letting remote attackers crash the server by sending malformed JSON data.

  • 7.5 /10 High
    CVE-2023-54393 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 4.20.5 contains a denial of service vulnerability caused by improper validation in JsonMapper during LoginPacket JSON parsing, letting attackers crash the server by sending malformed JSON structures, exploit requires network access.

  • 7.5 /10 High
    CVE-2023-54390 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 5.3.1 and < 4.23.1 contain a denial of service vulnerability caused by improper null value handling in LoginPacket JSON parsing, letting attackers crash the server by sending malformed JSON with unexpected null elements.

  • 7.5 /10 High
    CVE-2023-54355 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 5.3.1 and < 4.23.1 contain a denial of service caused by improper validation of identityPublicKey curve in LoginPacket, letting attackers crash the server by triggering exceptions during ECDH key derivation, exploit requires sending crafted LoginPackets.

  • 7.1 /10 High
    CVE-2026-86819 Auth required

    Waves Central - Privilege Escalation

    Waves Central for macOS contains a local privilege escalation caused by improper code-signing certificate validation in the privileged helper service, letting local authenticated users execute code with root privileges, exploit requires local authentication.

  • 7.3 /10 High
    CVE-2026-86810 No auth

    Open-Web-Analytics - Authentication Bypass

    Open-Web-Analytics <= 1.9.1 contains an authentication bypass caused by improper authentication in checkCapabilityAndAuthenticateUser function in Controller, letting remote attackers bypass authentication, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-86808 No auth

    moltis-org moltis - Authentication Bypass

    moltis-org moltis <= 20260818.10 contains a broken authentication caused by manipulation in vault_unlock_handler/vault_recovery_handler in vault.rs, letting remote attackers bypass authentication, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-86806 No auth

    opengeos GeoLibre - Server-Side Request Forgery

    opengeos GeoLibre <= 2.3.0 contains a server-side request forgery caused by manipulation in the _is_within_roots function, letting remote attackers make arbitrary server requests, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-86716 No auth

    Cesanta mJS - Buffer Overflow

    Cesanta mJS <= 1.26 contains a heap-based buffer overflow caused by improper handling in skip_spaces_and_comments function in src/mjs_tok.c, letting remote attackers cause memory corruption, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-86673 No auth

    ningzichun Student Management System - Hardcoded Credentials

    ningzichun Student Management System contains hardcoded credentials caused by manipulation in mysqli_connect function in config/database.php, letting remote attackers access sensitive credentials, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-86669 No auth

    aircheng-org iWebShop-5 - Authentication Bypass

    aircheng-org iWebShop-5 <= 5.15 contains an authentication bypass caused by manipulation of the "Name" argument in controllers/systemseller.php Login function, letting remote attackers bypass authentication, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-86083 Auth required

    n8n - Server-Side Template Injection

    n8n < 1.123.76, 2.37.7, 2.38.2 contains a server-side template injection caused by mutable global JSON.stringify usage in legacy expression engine, letting attackers execute arbitrary code, exploit requires expression injection.

  • 8.8 /10 High
    CVE-2026-86076 Auth required

    n8n - Server-Side Template Injection

    n8n < 1.123.76, 2.37.7, 2.38.2 contains a server-side template injection caused by improper sanitizer rebinding via reserved class member __sanitize in PrototypeSanitizer, letting attackers execute backend code and editor-preview JavaScript, exploit requires crafted expression with reserved class member.