Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 783 of 891
- 7.5 /10 HighCVE-2026-54567
Flask-Reuploaded - Unrestricted File Upload
Flask-Reuploaded 1.5.0 to <1.6.0 contains a file upload vulnerability caused by inconsistent extension case handling in UploadSet.save, letting attackers bypass lowercase denylist and upload executable files, exploit requires denylist configuration and user-controlled filename.
- 8.4 /10 HighCVE-2026-54447
GarminConnect - Information Disclosure
GarminConnect < 0.3.5 contains an information disclosure vulnerability caused by insecure file permissions on OAuth token directory and garmin_tokens.json, letting unprivileged users read tokens and access victim's Garmin Connect data, exploit requires shared host environment.
- 9.8 /10 CriticalCVE-2026-54334 No auth
UEFI Firmware Parser - Buffer Overflow
UEFI Firmware Parser < 1.14 contains a buffer overflow caused by improper bounds checking in ReadCLen() during parsing of Tiano or EFI compressed firmware, letting attackers cause heap corruption, crash, or potential code execution, exploit requires crafted firmware input.
- 9.8 /10 CriticalCVE-2026-54333 No auth
UEFI Firmware Parser - Buffer Overflow
UEFI Firmware Parser < 1.14 contains a buffer overflow caused by lack of validation of bit-length values in MakeTable() during Tiano or EFI compressed firmware parsing, letting attackers cause stack corruption and potential code execution, exploit requires crafted firmware bitstream.
- 8.1 /10 HighCVE-2026-54182 No auth
Backpack CRUD - Command Injection
Backpack CRUD < 4.1.70, 5.6.2, 6.8.13, and 7.0.36 contains a command injection caused by unsanitized HTTP Host header used in exec() shell command in Backpack\CRUD\Stats::makeCurlRequest, letting unauthenticated attackers execute OS commands as web-server user, exploit requires reaching a 1-in-100 random gate.
- 7.6 /10 HighCVE-2026-54180 Auth required
Backpack/crud - Broken Access Control
Backpack/crud 6.0.0 to 6.8.14 and 7.0.38 contains a broken access control caused by unscoped model queries in Update, Delete, and Reorder operations, letting authenticated users modify out-of-scope records, exploit requires authentication.
- 8.1 /10 HighCVE-2026-54178 Auth required
Backpack/crud - Broken Access Control
Backpack/crud < 6.8.12 and < 7.0.35 contains an insecure file deletion vulnerability caused by trusting disk-relative paths from clear_<attribute>[] in HasUploadFields::uploadMultipleFilesToDisk, letting authenticated users with Update access delete arbitrary files on the configured disk, exploit requires authenticated Update access.
- 7.6 /10 HighCVE-2026-54175 Auth required
Backpack CRUD - Broken Access Control
Backpack CRUD < 6.8.11 and < 7.0.34 contains a broken access control caused by improper mass assignment in MyAccountController::postAccountInfoForm, letting authenticated attackers escalate privileges or take over accounts via crafted requests.
- 7.5 /10 HighCVE-2026-54156 No auth
node-opcua - Denial of Service
node-opcua prior to 2.166.0 contains a denial of service caused by unbounded nonce cache growth in server_secure_channel_layer.ts, letting unauthenticated remote attackers exhaust server memory, exploit requires repeated session creation with unique nonces.
- 7.7 /10 HighCVE-2026-54155
node-opcua - Authentication Bypass
node-opcua < 2.166.0 contains a broken authentication caused by improper verification of RSA-OAEP password blob and missing nonce binding in UserNameIdentityToken handler, letting unauthenticated remote attackers compromise accounts and replay tokens, exploit requires attacker to obtain server public key.
- 7.6 /10 HighCVE-2026-54087 Auth required
EasyAdmin - Stored XSS & Privilege Escalation
EasyAdmin 5.0.0 to 5.0.13 contains a stored XSS caused by browser-executable file uploads in FileField and ImageField without proper Content-Disposition headers, letting attackers execute JavaScript in authenticated admin's origin, exploit requires privilege gap between uploader and viewer.
- 7.5 /10 HighCVE-2026-53752 No auth
docx4j - Denial of Service
docx4j prior to 11.5.14 contains a denial of service caused by unbounded recursion in PropertyResolver due to cyclic w:basedOn style inheritance, letting attackers terminate worker threads, exploit requires processing untrusted DOCX files.
- 7.4 /10 HighCVE-2026-53714 No auth
Envoy Gateway - Authentication Bypass
Envoy Gateway < 1.7.4 and < 1.8.1 contains an authentication bypass caused by missing UnaryInterceptor and incomplete JWT validation in xDS gRPC server, letting attackers with network access retrieve sensitive configuration and TLS keys, exploit requires network access to port 18000.
- 9.1 /10 CriticalCVE-2026-53713 Auth required
Envoy Gateway - Path Traversal
Envoy Gateway < 1.7.4 and < 1.8.1 contains a file system read caused by improper path normalization in to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua, letting attackers read arbitrary files from the gateway controller pod, exploit requires submission of Lua code through EnvoyExtensionPolicy.
- 7.5 /10 HighCVE-2026-53659 No auth
http4k - Denial of Service
http4k < 4.51.0.0, 5.42.0.0, and 6.49.0.0 contain a denial of service caused by unlimited gzip decompression size in ServerFilters.GZip and RequestFilters.GunZip, letting unauthenticated clients exhaust JVM heap, exploit requires sending crafted gzip request.