Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 771 of 891

  • 8.3 /10 High
    CVE-2026-90707 No auth

    Open5GS - Use After Free

    Open5GS <= 2.7.x contains a use after free vulnerability caused by manipulation of the discovery_option argument in amf_nnrf_try_old_amf_discovery_fallback function, letting remote attackers cause memory corruption, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-90703 Auth required

    D-Link DWR-M921 - Command Injection

    D-Link DWR-M921 1.1.52 contains a command injection caused by manipulation of the "folderpath" argument in /boafrm/formDiskCreateShare system function, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-90702 Auth required

    D-Link DWR-M921 - Command Injection

    D-Link DWR-M921 1.1.52 contains a command injection caused by manipulation of the "partition" argument in /boafrm/formDiskFormat, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90701 No auth

    subhajitkhan online-clinic-management-system - SQL Injection

    subhajitkhan online-clinic-management-system contains a SQL injection caused by manipulation of the "searchtext" argument in listdoctor.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-90699 Auth required

    D-Link DWR-M920 - Command Injection

    D-Link DWR-M920 1.1.7 contains a command injection caused by manipulation of the "newPin" argument in /boafrm/formPinManageSetup, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-90693 Auth required

    D-Link DIR-878 - Buffer Overflow

    D-Link DIR-878 120B05 contains a stack-based buffer overflow caused by manipulation of the Primary/Secondary argument in SetWan3Settings of WAN Settings, letting remote attackers execute arbitrary code, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-90692 Auth required

    D-Link DIR-878 - Buffer Overflow

    D-Link DIR-878 120B05 contains a stack-based buffer overflow caused by manipulation of the IPv6Address/Hostname argument in SetDynamicDNSIPv6Settings, letting remote attackers execute arbitrary code, exploit requires crafted request.

  • 8.3 /10 High
    CVE-2026-90691 No auth

    0x4m4 HexStrike AI - Path Traversal

    0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04 contains a path traversal caused by manipulation of the "filename" argument in FileOperationsManager of hexstrike_server.py API Files Endpoint, letting remote attackers access arbitrary files, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90690 No auth

    0x4m4 HexStrike AI - Command Injection

    0x4m4 HexStrike AI contains a command injection caused by manipulation of arguments in subprocess.Popen in hexstrike_server.py API Tools Endpoint, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-90689 Auth required

    Tenda W20E - Buffer Overflow

    Tenda W20E 15.11.0.61068_1546_841_CN_TDC contains a stack-based buffer overflow caused by manipulation of the argument webAuthWhiteUserIndex in formDelWebAuthWhiteUser, letting remote attackers cause memory corruption, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-90680 Auth required

    D-Link DIR-823G - Buffer Overflow

    D-Link DIR-823G 1.0.2B05_20181207 contains a stack-based buffer overflow caused by improper handling of PAddress/SubnetMask/Gateway arguments in /HNAP1/SetStaticRouteSettings, letting remote attackers execute code, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-90620 No auth

    0x4m4 HexStrike AI - Authentication Bypass

    0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04 contains an authentication bypass caused by missing authentication in API Command Endpoint, letting remote attackers bypass authentication, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-90619 No auth

    0x4m4 HexStrike AI - Command Injection

    0x4m4 HexStrike AI contains a command injection caused by manipulation of the "code/script" argument in hexstrike_server.py Execute Endpoint, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90618 No auth

    GH05TCREW PentestAgent - Command Injection

    GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2 contains a command injection caused by manipulation in LocalRuntime.execute_command in runtime/runtime.py, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-90617 No auth

    GH05TCREW PentestAgent - Command Injection

    GH05TCREW PentestAgent contains a command injection caused by manipulation in run_task function of MCP HTTP Server component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.