Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 777 of 891
- 9.8 /10 CriticalCVE-2026-82439 No auth
Apache Storm DRPC - Denial of Service
Apache Storm DRPC server contains a memory exhaustion vulnerability caused by unbounded retention of function name entries in request queues, letting unauthenticated attackers exhaust server heap by sending distinct function names, exploit requires no credentials.
- 8.1 /10 HighCVE-2026-82438 Auth required
Apache Storm - Broken Access Control
Apache Storm < 3.1.0 contains a broken access control caused by improper CORS and JSONP handling in HTTP components, letting authenticated users' web pages on unrelated origins read sensitive cluster and log data, exploit requires authenticated user interaction.
- 9.8 /10 CriticalCVE-2026-82435 No auth
Apache Storm - Denial of Service
Apache Storm contains a denial of service vulnerability caused by the Netty message decoder allocating large buffers before SASL authentication, letting unauthenticated attackers with TCP access to worker ports cause resource exhaustion, exploit requires TCP reachability to worker port.
- 8.1 /10 HighCVE-2026-82432
Apache Nimbus - Broken Access Control
Apache Nimbus < 3.1.0 contains an authorization bypass caused by insufficient validation of topology.blobstore.map and lack of authorization in listBlobs, letting attackers with rebalance rights or network access disclose blob metadata and introduce unauthorized blobstore entries, exploit requires rebalance privileges or network access to Nimbus Thrift port.
- 9.8 /10 CriticalCVE-2026-82431 No auth
Apache Storm - Broken Access Control
Apache Storm < 3.1.0 contains a broken access control caused by improper evaluation of nimbus.groups when nimbus.users is empty in SimpleACLAuthorizer, letting authenticated operators bypass group restrictions and perform all user-level operations, exploit requires cluster access with authentication.
- 7.8 /10 HighCVE-2026-82430 Auth required
Apache Storm - Command Injection
Apache Storm contains a command injection caused by improper validation and ownership change timing in the worker-launcher command file handling, letting attackers launch root-equivalent containers or bind-mount arbitrary host paths, exploit requires tenant control over worker directory.
- 7.8 /10 HighCVE-2026-82429 Auth required
Apache Storm - Privilege Escalation
Apache Storm < 3.1.0 contains a privilege escalation caused by TOCTOU race condition in setuid-root worker-launcher binary using lchown and chmod on re-resolved paths, letting untrusted tenant escalate privileges by symlink attack, exploit requires running untrusted topology code on supervisor node.
- 8.8 /10 HighCVE-2026-82428 Auth required
Apache Storm - Remote Code Execution
Apache Storm before 3.1.0 contains a remote code execution vulnerability caused by predictable blob keys for dependency artifacts uploaded with `storm jar --artifacts`, letting a malicious user inject code into other tenants' topologies, exploit requires multi-tenant cluster and use of `--artifacts` feature.
- 7.8 /10 HighCVE-2026-82427 Auth required
Apache Storm - Path Traversal & Remote Code Execution
Apache Storm contains a path traversal vulnerability in topology.blobstore.map allowing submitters to manipulate symlink targets, letting attackers as supervisor user delete files and execute code as other OS users, exploit requires topology submission.
- 9.8 /10 CriticalCVE-2026-82232 No auth
Apache Syncope - SQL Injection
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an SQL injection caused by unsanitized sort clauses in Task search, letting administrators execute arbitrary SQL via stacked queries, exploit requires administrator privileges.
- 8.4 /10 HighCVE-2026-82049 No auth
CPython - Path Traversal
CPython <= 3.13 contains a symlink & hard link vulnerability in the tarfile module's data and extraction filters, letting attackers modify file metadata or expose file contents outside the extraction directory, exploit requires crafted archive.
- 7.1 /10 HighCVE-2026-82035 No auth
PyMuPDF - Path Traversal
PyMuPDF <= 1.28.2 contains a path traversal vulnerability caused by improper sanitization of BaseFont names in extract_objects() font branch, letting attackers write arbitrary files outside the output directory, exploit requires crafted document input.
- 8.8 /10 HighCVE-2026-82028 Auth required
Magistrala - SQL Injection
Magistrala < 1.0.0 contains a SQL injection caused by unsafe interpolation of the format query parameter in timescale-reader and postgres-reader HTTP API services, letting authenticated attackers execute arbitrary SQL with superuser privileges.
- 8.1 /10 HighCVE-2026-81902 No auth
Concrete CMS - Cross-Site Request Forgery
Concrete CMS 9 through 9.5.2 contains a cross-site request forgery caused by missing CSRF token validation in the orphaned block removal panel action, letting remote attackers delete page blocks via an authenticated user with edit permissions.
- 8.7 /10 HighCVE-2026-81901 Auth required
Concrete CMS - Stored XSS
Concrete CMS 9.2.0 through 9.5.2 contains a stored XSS caused by missing authorization checks on page properties, templates, and types in the REST API page update endpoint, letting users with content-editing rights persist JavaScript executing in visitors' browsers, exploit requires user with content-editing rights.