Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 8 of 677

  • 7.5 /10 High
    CVE-2026-97394 No auth

    kin-openapi - Denial of Service

    kin-openapi 0.136.0 to 0.143.0 contains a null pointer dereference caused by accepting OpenAPI 3.1 array schemas without an items keyword in openapi3filter, letting remote unauthenticated clients trigger a panic during request or response validation, exploit requires sending nonempty requests or matching responses.

  • 7.5 /10 High
    CVE-2026-100354 No auth

    kin-openapi - Denial of Service

    kin-openapi < 0.149.0 contains a denial of service caused by lack of cycle detection in runtime validation of schemas with circular references, letting attackers cause unbounded recursion and crash the process, exploit requires crafted request triggering affected schema.

  • 7.5 /10 High
    CVE-2026-100353 No auth

    kin-openapi - Denial of Service

    kin-openapi 0.136.0 to 0.149.0 contains a denial of service caused by missing nil-items guard in openapi3filter decoder paths for OpenAPI 3.1 array schemas, letting unauthenticated remote clients trigger nil-pointer panic via crafted query or request body parameters, exploit requires crafted request with specific array parameters.

  • 7.5 /10 High
    CVE-2026-100352 No auth

    kin-openapi - Denial of Service

    kin-openapi < 0.148.0 contains a denial of service caused by improper handling of YAML NaN and infinity numeric values in validation, letting remote unauthenticated clients cause server panic and potential process termination, exploit requires sending crafted YAML request bodies.

  • 8.2 /10 High
    CVE-2026-100349 No auth

    kin-openapi - Denial of Service

    kin-openapi < 0.146.0 contains a denial of service caused by passing a nil response header schema to decodeValue in openapi3filter.ValidateResponse, letting remote attackers or local users cause application crashes, exploit requires triggering the affected operation.

  • 7.4 /10 High
    CVE-2026-100351 No auth

    kin-openapi - Authentication Bypass

    kin-openapi 0.144.0 to 0.147.0 contains an authentication bypass caused by mismatch between decoded URL.Path validation and raw URL.RawPath dispatch in gorilla/mux router, letting unauthenticated remote attackers access protected handlers, exploit requires overlapping public and protected routes with encoded path separator.

  • 7.5 /10 High
    CVE-2026-97370 No auth

    Junrar - Denial of Service

    Junrar prior to 7.6.1 contains a denial of service caused by improper handling of VM_JMP instruction in RarVM.java, letting attackers cause infinite CPU loops and exhaust worker capacity, exploit requires crafted RAR4 archive.

  • 9.8 /10 Critical
    CVE-2026-111329 No auth

    JuggleIM im-server - Authentication Bypass

    JuggleIM im-server through 1.8.16 contains a broken authentication caused by default administrator credentials admin/123456, letting unauthenticated remote attackers access the admin console and control tenant applications, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-102946 No auth

    joserfc - Authentication Bypass

    joserfc < 1.7.4 contains an authentication bypass caused by accepting JWS General JSON Serialization with an empty signatures array in jws.deserialize_json(), letting attackers supply arbitrary payloads treated as authentic, exploit requires crafted JWS General JSON input.

  • 9.8 /10 Critical
    CVE-2026-111281 No auth

    Jooan JA-A12 - Remote Code Execution

    Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution caused by hard-coded credentials in jooandiag daemon, letting unauthenticated attackers execute root commands remotely via /goform/SingleHandlebyCommand.

  • 8.1 /10 High
    CVE-2026-111094 No auth

    JetBrains TeamCity - Remote Code Execution

    JetBrains TeamCity < 2026.2, 2026.1.4, 2025.11.8 contains a remote code execution caused by whitelist bypass in the build messages protocol, letting remote attackers execute arbitrary code, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-111093 No auth

    JetBrains Datalore - Path Traversal

    JetBrains Datalore < 2026.2.1 contains a path traversal caused by unauthenticated access to the report blob endpoint, letting unauthenticated attackers read arbitrary files remotely, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-104828 No auth

    HtmlUnit Neko - Stored XSS

    HtmlUnit Neko < 5.4.0 contains a stored XSS caused by improper entity encoding in TEXTAREA and TITLE elements during parse-and-serialize, letting attackers inject executable markup, exploit requires attacker-controlled input.

  • 8.8 /10 High
    CVE-2026-110922 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.84 contains a use after free vulnerability in Prerender, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-110921 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.84 contains a use after free vulnerability in V8, caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.