Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 816 of 891
- 8.8 /10 HighCVE-2026-73784 Auth required
HPE IceWall - Authentication Bypass
HPE IceWall contains a broken access control vulnerability caused by tampering of SAML response, letting attackers impersonate other users, exploit requires crafted SAML response.
- 9.8 /10 CriticalCVE-2026-72710 No auth
SPIP - Remote Code Execution
SPIP before 4.4.18 contains a remote code execution caused by lack of editable columns allowlist in editer_objet action's arg parameter, letting attackers with valid nonce execute arbitrary PHP functions via spip_jobs table injection.
- 9.8 /10 CriticalCVE-2026-72709 No auth
SPIP - Broken Access Control
SPIP < 4.4.18 contains a missing authorization vulnerability in administrative action endpoints under ecrire/action/ caused by lack of server-side permission checks via autoriser(), letting unauthenticated attackers perform privileged actions including password resets by supplying a valid HMAC-SHA256 nonce.
- 7.5 /10 HighCVE-2026-72708 PoC publicNo auth
SPIP - SQL Injection
SPIP < 4.4.18 contains an unauthenticated blind SQL injection caused by improper escaping in spip_mysql_cite() for date columns in the public sitemap endpoint, letting attackers extract database content via crafted annee parameter.
- 7.5 /10 HighCVE-2026-71646 No auth
Robotics-STAR-Lab RACER - Denial of Service
Robotics-STAR-Lab RACER commit abcdef1234567890 contains a denial of service caused by improper handling in FastExplorationFSM::optTimerCallback() in swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp, letting attackers cause service disruption, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-71644
Robotics-STAR-Lab RACER Tested - Unsafe Trajectory Planning
Robotics-STAR-Lab RACER Tested commit abcdef1234567890 contains an unsafe trajectory planning vulnerability caused by a missing default case in the FSM stopping swarm trajectory publishing when drone enters IDLE, letting attackers cause UAV collisions, exploit requires control over drone state.
- 7.5 /10 HighCVE-2026-71641 No auth
ZJU-FAST-Lab EGO-Planner-v2 - Denial of Service
ZJU-FAST-Lab EGO-Planner-v2 <= 5c99a95880401e2599638d567abc0e240396cb42 contains a denial of service caused by interaction issues between traj_server, poscmd_2_odom, and EGOReplanFSM emergency recovery logic, letting attackers cause service disruption remotely, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-71416
Headroom - Authentication Bypass
Headroom < 0.35.0 contains an authentication bypass caused by lack of Origin header validation in WebSocket requests, letting malicious WebSocket clients perform arbitrary LLM requests without authentication, exploit requires attacker to have access to Headroom proxy and OpenAI API key.
- 8.5 /10 HighCVE-2026-70341 Auth required
Microsoft Edge - Remote Code Execution
Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows authorized attackers to execute code remotely over a network, exploit requires attacker authorization.
- 7.5 /10 HighCVE-2026-68497 No auth
Jackson-databind - Denial of Service
Jackson-databind 2.0.0 < 2.18.10, 2.19.0 < 2.21.6, 2.22.0 < 2.22.2, 3.0.0 < 3.1.6, and 3.2.0 < 3.2.2 contains a denial of service caused by unbounded numeric string parsing in XML datatype deserializers, letting unauthenticated attackers exhaust CPU resources via crafted JSON input, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-67211 No auth
Apache OpenNLP - Denial of Service
Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 contain a denial of service caused by unbounded map pre-sizing in SymSpellModelSerializer.create() when reading attacker-controlled count fields from a binary model, letting attackers exhaust heap memory, exploit requires loading untrusted SymSpell model files.
- 7.6 /10 HighCVE-2026-62112 Auth required
Amelia - SQL Injection
Amelia <= 2.4.9 contains a SQL injection caused by improper input sanitization in the editor component, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.6 /10 HighCVE-2026-62109 Auth required
Sky Addons for Elementor - SQL Injection
Sky Addons for Elementor <= 3.8.4 contains a SQL injection caused by improper input sanitization in the editor component, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-62107 Auth required
Masteriyo - LMS - Remote Code Execution
Masteriyo - LMS <= 3.4.0 contains an unauthenticated PHP object injection caused by improper handling of user input, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-62106 Auth required
SMS Alert Order Notifications - Privilege Escalation
SMS Alert Order Notifications <= 3.9.9 contains a privilege escalation caused by improper access control, letting subscribers escalate their privileges, exploit requires subscriber access.