Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 825 of 891
- 9.6 /10 CriticalCVE-2026-87931 No auth
Behavioral Technology Group Pavlok Behavioral Conditioning Wearable - Buffer Overflow
Behavioral Technology Group Pavlok Behavioral Conditioning Wearable <= 20260707 contains a buffer overflow caused by manipulation in Apple Notification Center Service Event Handler, letting local network attackers cause memory corruption, exploit requires local network access.
- 7.3 /10 HighCVE-2026-87925 No auth
Rizwan17 inventory-management-system - SQL Injection
Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f contains a SQL injection caused by manipulation of the argument pro_name[] in storeCustomerOrderInvoice function in includes/manage.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-87803 Auth required
Countly Server - Authorization Bypass
Countly Server DBViewer contains an authorization bypass caused by flawed sub-pipeline detection in the aggregation stage sanitizer, letting non-admin users with read permission perform unauthorized cross-collection joins and access sensitive data, exploit requires DBViewer read permission.
- 8.3 /10 HighCVE-2026-87090 Auth required
Consul - Authorization Bypass
Consul and Consul Enterprise contain an authorization bypass caused by improper access control in the catalog node-write path, letting authenticated attackers delete other nodes' catalog registrations and take over node identities, exploit requires node-write permission and knowledge of target node ID.
- 7.5 /10 HighCVE-2026-86093
IBM Db2 - Command Injection
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a command injection caused by a stack-based buffer overflow in DRDA server endpoint handling, letting attackers execute arbitrary commands on clients, exploit requires control or impersonation of DRDA server endpoint.
- 7.1 /10 HighCVE-2026-85545 Auth required
HikCentral Access Control - Broken Access Control
HikCentral Access Control contains a broken access control vulnerability caused by authenticated low-privilege users invoking unauthorized API interfaces, letting attackers access restricted functions, exploit requires authenticated low-privilege user.
- 9.1 /10 CriticalCVE-2026-85228 No auth
Amazon Deep Java Library - Integer Overflow
Amazon Deep Java Library (DJL) 0.13.0 through 0.36.0 contains an integer overflow caused by improper tensor buffer validation, letting remote unauthenticated actors cause denial of service or information disclosure via crafted tensor payloads.
- 8.6 /10 HighCVE-2026-85217 No auth
Autodesk Fusion Desktop - Broken Access Control
Autodesk Fusion Desktop contains a broken access control vulnerability caused by a maliciously crafted add-in modifying persistent network proxy settings without user consent, letting attackers redirect authenticated network traffic, exploit requires add-in installation and execution.
- 9.8 /10 CriticalCVE-2026-85025 No auth
IBM Langflow OSS - Remote Code Execution
IBM Langflow OSS 1.0.0 through 1.11.5 contains a remote code execution caused by improper enforcement of public-flow security restrictions and session isolation controls in MCP project endpoints, letting unauthenticated attackers execute arbitrary code and access or modify chat sessions, exploit requires publicly shared MCP project endpoints.
- 9.1 /10 CriticalCVE-2026-84939 No auth
Apache FreeMarker - Path Traversal
Apache FreeMarker 2.2.0 through 2.3.34 contains a path traversal caused by specifying a malformed locale identifier with localized lookup enabled, letting attackers access unintended template files, exploit requires localized lookup enabled.
- 8.8 /10 HighCVE-2026-84889 Auth required
IBM Langflow OSS - Remote Code Execution
IBM Langflow OSS 1.0.0 through 1.10.3 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting remote authenticated attackers execute arbitrary code.
- 7.5 /10 HighCVE-2026-84821 No auth
WP Fast Total Search - Broken Access Control
WP Fast Total Search <= 1.82.284 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-84819 No auth
WPAdverts - Reflected XSS
WPAdverts <= 2.3.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-84816 No auth
WPCS - Reflected XSS
WPCS <= 1.3.2 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 7.8 /10 HighCVE-2026-84042 Auth required
crun - Privilege Escalation
crun >= 1.29 contains a privilege escalation caused by executing attacker-controlled payload from container image with host root privileges when built with libkrun and rootful passt networking, letting attackers gain host root privileges, exploit requires rootful container with passt networking enabled.