Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 819 of 891
- 7.3 /10 HighCVE-2026-89087 No auth
OCaml cstruct - Out of Bounds Read
OCaml cstruct before 6.3.0 contains an out of bounds read caused by mishandling indexes, letting attackers potentially cause denial of service or information disclosure, exploit requires crafted input.
- 9.1 /10 CriticalCVE-2026-89086 No auth
jose OCaml - Authentication Bypass
jose package for OCaml < 0.11.0 contains a broken authentication caused by incomplete RSA signature validation that only checks PKCS #1 decoding without verifying the public key, letting attackers bypass signature verification, exploit requires crafted signature input.
- 8.2 /10 HighCVE-2026-89054 No auth
OpenNMS Horizon - Broken Access Control
OpenNMS Horizon contains a missing authorization vulnerability caused by lack of authorization enforcement on PATCH endpoints in /api/v2 REST API, letting unauthenticated attackers disable event and SNMP data collection, exploit requires attacker to access the web UI.
- 9.9 /10 CriticalCVE-2026-89049 Auth required
Amazon AWS Systems Manager Agent - Server-Side Request Forgery
Amazon AWS Systems Manager Agent (SSM Agent) < 3.3.4851.0 contains a server-side request forgery caused by improper validation of equivalent address representations in port forwarding, letting authenticated remote users bypass denylist and access link-local endpoints, exploit requires authentication.
- 8.2 /10 HighCVE-2026-89046 No auth
zstd-jni - Out of Bounds Read
zstd-jni 1.5.5-6 through 1.5.7-13 contains an out-of-bounds read caused by lack of validation of negative srcPosition arguments in Zstd.getFrameContentSize, letting attackers cause information disclosure or JVM crashes, exploit requires crafted input with negative offset.
- 7.4 /10 HighCVE-2026-89043 No auth
passport-saml-encrypted - Authentication Bypass
passport-saml-encrypted <= 0.1.13 contains an XML signature wrapping vulnerability caused by independent XPath lookups without cross-validation in signature verification and assertion extraction, letting attackers with any valid signed SAML message bypass authentication, exploit requires attacker to hold a valid signed SAML message.
- 9.1 /10 CriticalCVE-2026-89042 No auth
passport-saml-encrypted - Authentication Bypass
passport-saml-encrypted <= 0.1.13 contains an authentication bypass caused by conditional SAML signature verification based on an optional cert option, letting attackers submit unsigned SAML responses to bypass authentication, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-89011 No auth
isomorphic-git - Prototype Pollution
isomorphic-git < 1.42.0 contains a prototype pollution vulnerability caused by crafted ref names with '__proto__' path segments in getRemoteInfo, letting malicious Git server operators reroute network operations and leak credentials, exploit requires attacker-controlled Git server.
- 8.8 /10 HighCVE-2026-88959 Auth required
Anchor CMS - Broken Access Control
Anchor CMS <= 0.12.7 contains a broken access control vulnerability caused by failure to enforce role-based access control in admin user-management endpoints, letting authenticated low-privilege users create or modify administrator accounts, exploit requires authenticated user with editor or user role.
- 8.3 /10 HighCVE-2026-88939 Auth required
knowns - Broken Access Control
knowns through 0.33.0 contains a broken access control caused by exemption of project.set action from permission guard checks, letting attackers with read-only agent sessions bypass restrictions and gain write access, exploit requires read-only agent session.
- 8.8 /10 HighCVE-2026-88937 No auth
knowns - Path Traversal
knowns through 0.33.0 contains a path traversal caused by improper validation of template destination paths in the code generation template engine, letting attackers read and write arbitrary files outside the project root, exploit requires supplying malicious templates.
- 7.0 /10 HighCVE-2026-88924 Auth required
gvfs - Privilege Escalation
gvfs admin backend contains a TOCTOU race condition in gvfsd-admin daemon's chown() call on user-controlled directory pathnames, letting authenticated local attackers escalate privileges to root by modifying root-owned files.
- 9.8 /10 CriticalCVE-2026-88899 PoC publicNo auth
OpenCode - Path Traversal
OpenCode < 0.31.0 contains a path traversal caused by improper validation of the x-opencode-directory header in /api/opencode proxy endpoint, letting remote attackers perform file operations outside the project root, exploit requires crafted request.
- 7.2 /10 HighCVE-2026-88895 Auth required
CyberPanel - Authentication Bypass
CyberPanel < 3.0.5 contains a broken authentication caused by failure to enforce two-factor authentication on API endpoints, letting attackers with administrator passwords bypass TOTP and perform administrative actions without second factor.
- 7.5 /10 HighCVE-2026-88893 No auth
OpenPanel - Broken Access Control
OpenPanel contains an information disclosure caused by failure to validate access controls in share lookup procedures, letting unauthenticated attackers retrieve password hashes and report definitions via share links, exploit requires share link access.