Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 835 of 891

  • 7.7 /10 High
    CVE-2026-87825 No auth

    zstd-jni - Use After Free

    zstd-jni < 1.5.7-14 contains a use-after-free vulnerability caused by dictionary shared lock being held only during load call, letting attackers cause silent data corruption or JVM crashes by closing dictionary while referenced.

  • 7.5 /10 High
    CVE-2026-87824 No auth

    zstd-jni - Denial of Service

    zstd-jni before 1.5.7-14 contains an out-of-bounds read caused by improper validation of samples buffer capacity in Zstd.trainFromBufferDirect, letting attackers cause JVM termination by supplying crafted sample lengths, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-87823 No auth

    zstd-jni - Out of Bounds Read

    zstd-jni before 1.5.7-14 contains a buffer overflow caused by 32-bit signed bounds checks on direct-ByteBuffer frame-size native methods, letting attackers read out-of-bounds memory, exploit requires crafted input with negative or overflowing offsets.

  • 7.5 /10 High
    CVE-2026-87822 No auth

    t-digest - Denial of Service

    t-digest 3.1 through 3.3 contains a denial of service caused by failure to validate centroid means during deserialization in MergingDigest.fromBytes, letting attackers inject NaN values that degrade sorting performance, exploit requires crafted serialized digests.

  • 7.1 /10 High
    CVE-2026-87821 Auth required

    Lara Dashboard - Server-Side Request Forgery

    Lara Dashboard <= 1.3.1 contains a server-side request forgery caused by lack of host validation and redirect restrictions in POST /api/admin/builder/markdown/fetch, letting authenticated users fetch arbitrary URLs and read responses.

  • 7.5 /10 High
    CVE-2026-87819 PoC publicNo auth

    GitPython - Denial of Service

    GitPython < 3.1.60 contains a regular expression denial of service caused by malformed author field processing in Actor.name_email_regex, letting attackers exhaust CPU resources, exploit requires crafted commit object.

  • 8.8 /10 High
    CVE-2026-87817 PoC publicNo auth

    GitPython - Remote Code Execution

    GitPython < 3.1.60 contains a code execution vulnerability caused by improper validation of git directory location using tracked files like gitdir, commondir, and HEAD, letting attackers execute arbitrary code when victims call index.commit() on cloned or opened repositories.

  • 7.5 /10 High
    CVE-2026-87816 No auth

    PasswordPusher - Race Condition

    PasswordPusher < 2.11.1 contains a race condition in view limit enforcement, letting unauthenticated attackers bypass expire_after_views limits by sending concurrent requests to the show endpoint.

  • 8.7 /10 High
    CVE-2026-87815 Auth required

    SiYuan - Path Traversal

    SiYuan < v3.8.2 contains a path traversal caused by improper validation of the deckID parameter in /api/riff/removeRiffDeck, letting authenticated administrators delete arbitrary .deck and .cards files outside the workspace directory.

  • 7.3 /10 High
    CVE-2026-87814 Auth required

    SiYuan - Stored XSS

    SiYuan < 3.8.2 contains a stored cross-site scripting vulnerability caused by failure to escape indexed asset content in the search asset preview feature, letting attackers execute JavaScript in the SiYuan origin, exploit requires attacker to place crafted text assets in a workspace.

  • 7.3 /10 High
    CVE-2026-87813 Auth required

    SiYuan - Stored XSS

    SiYuan < 3.8.2 contains a stored XSS caused by unescaped asset filenames in Search Assets result list, letting authenticated attackers execute JavaScript in victim browsers, exploit requires authentication.

  • 7.3 /10 High
    CVE-2026-87811 Auth required

    SiYuan - Stored XSS

    SiYuan < 3.8.2 contains a stored XSS caused by improper attribute encoding of persisted notebook template paths in HTML input value attributes, letting attackers execute JavaScript when victims open notebook configuration, exploit requires crafted malicious template paths.

  • 7.5 /10 High
    CVE-2026-87807 No auth

    Siyuan - SQL Injection

    Siyuan < v3.8.2 contains an authenticated SQL injection caused by improper sanitization of the method=1 query parameter in fullTextSearchBlock endpoint, letting authenticated attackers read sensitive document content by bypassing access controls.

  • 7.4 /10 High
    CVE-2026-87806 No auth

    Parse Server - Authentication Bypass

    Parse Server <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass caused by improper handling of zero-length passwords in the LDAP authentication adapter, letting unauthenticated attackers obtain valid session tokens, exploit requires LDAP authentication adapter enabled and directory allowing unauthenticated simple bind.

  • 8.2 /10 High
    CVE-2026-87795 No auth

    zstd-jni - Out of Bounds Read

    zstd-jni < 1.5.7-14 contains an out-of-bounds read caused by improper validation of offset and length parameters in ZstdDictCompress constructor, letting attackers read native heap memory, exploit requires supplying untrusted offset or length values.