Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 847 of 891

  • 9.9 /10 Critical
    CVE-2026-67401 PoC publicAuth required

    cPanel - SQL Injection

    cPanel contains a SQL injection caused by improper input sanitization in the EmailTrack component, letting mail-enabled accounts achieve remote code execution as root, exploit requires mail-enabled account access.

  • 8.1 /10 High
    CVE-2026-65181 Auth required

    Impala - Remote Code Execution

    Impala 2.7-4.5 contains a remote code execution caused by insufficient authorization of Data Source tables, letting clients with upload privileges execute arbitrary Java code remotely, exploit requires upload privileges.

  • 8.2 /10 High
    CVE-2026-6485

    UEFI BIOS - Authentication Bypass

    UEFI BIOS embedded Shell contains a Secure Boot bypass caused by shell commands or startup scripts, letting attackers bypass Secure Boot protections, exploit requires access to the embedded shell.

  • 8.8 /10 High
    CVE-2026-57866 Auth required

    Apache Impala - Server Side Request Forgery

    Apache Impala 4.4.x and 4.5.x contain a server side request forgery caused by improper access control in ai_generate_text() function, letting authenticated users exfiltrate secrets from credential providers, exploit requires known secret keys.

  • 7.0 /10 High
    CVE-2026-56711 No auth

    VLC media player - Integer Overflow

    VLC media player contains an integer overflow in AllocatePicture due to 32-bit arithmetic on picture buffer size calculation, letting remote attackers cause out-of-bounds write via crafted PNG with large dimensions, exploit requires opening the file.

  • 9.8 /10 Critical
    CVE-2026-56207

    Apache Impala - Authentication Bypass

    Apache Impala >=4.0.0 contains a broken authentication caused by lack of signature verification of Bearer token in the last step of SAML2 authentication for hs2-http interface, letting attackers alter user names and impersonate other users, exploit requires crafted Bearer token.

  • 9.6 /10 Critical
    CVE-2026-54694 No auth

    SkillTree - Stored XSS & CSRF Token Theft

    SkillTree < 4.4.2 contains a stored XSS caused by unsanitized user input in account registration fields and unsafe HTML rendering in StringHighlighter.js and HighlightedValue.vue, letting attackers execute arbitrary scripts in admin browsers, exploit requires attacker to self-register with crafted input.

  • 9.1 /10 Critical
    CVE-2026-53939 No auth

    OpenIDC cjose - Cryptographic Key Generation Flaw

    OpenIDC cjose 0.6.1 through 0.6.2.5 contains a cryptographic key generation flaw caused by zeroed content-encryption key in AES-CBC-HMAC JWE encryption, letting attackers decrypt and forge JWE content, exploit requires use of affected algorithms.

  • 8.2 /10 High
    CVE-2026-53938 No auth

    OpenIDC cjose - Out of Bounds Read/Write

    OpenIDC cjose < 0.6.2.5 contains a buffer overflow caused by lack of length validation on attacker-supplied encrypted_key in AES Key Wrap algorithms during JWE decryption, letting remote unauthenticated attackers cause heap corruption and denial of service, exploit requires crafted JWE input.

  • 7.5 /10 High
    CVE-2026-52482 No auth

    SJRC F11 SJ-GPS-PRO - Information Disclosure

    SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 contains an information disclosure vulnerability caused by inetd service spawning /app/sh_for_telnet, letting remote attackers obtain sensitive information, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-49315 No auth

    Input Device Module - Denial of Service

    An input device module contains a denial of service vulnerability caused by unspecified input handling issues, letting attackers disrupt availability, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-49314 No auth

    Rendering & Composition Module - Out of Bounds Write

    A rendering and composition module contains an out-of-bounds write vulnerability, letting attackers cause denial of service, exploit requires no special conditions.

  • 8.6 /10 High
    CVE-2026-49310

    Unknown Product - Broken Access Control

    An unspecified product contains a broken access control vulnerability in the event notification module, letting attackers affect service confidentiality, exploit requires unspecified conditions.

  • 9.8 /10 Critical
    CVE-2026-41871

    Apache Nutch - Unsafe Reflection

    Apache Nutch 1.10 through 1.22 contains an unsafe reflection vulnerability caused by use of externally-controlled input to select classes or code in Nutch Server (Nutch REST API), letting attackers bypass authorization, exploit requires access to Nutch Server.

  • 8.8 /10 High
    CVE-2026-41870 Auth required

    Apache Nutch - Code Injection

    Apache Nutch 1.11 through 1.22 contains a code injection and unsafe reflection vulnerability caused by missing authorization and improper control of dynamically-managed code in the Nutch REST API, letting attackers execute unauthorized code, exploit requires access to Nutch Server.