Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 850 of 891

  • 7.5 /10 High
    CVE-2024-58381 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 5.11.1 contains a denial of service vulnerability caused by improper object initialization from scalar JSON types in LoginPacket JSON processing, letting remote attackers crash the server by sending malformed JSON data.

  • 7.5 /10 High
    CVE-2023-54393 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 4.20.5 contains a denial of service vulnerability caused by improper validation in JsonMapper during LoginPacket JSON parsing, letting attackers crash the server by sending malformed JSON structures, exploit requires network access.

  • 7.5 /10 High
    CVE-2023-54390 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 5.3.1 and < 4.23.1 contain a denial of service vulnerability caused by improper null value handling in LoginPacket JSON parsing, letting attackers crash the server by sending malformed JSON with unexpected null elements.

  • 7.5 /10 High
    CVE-2023-54355 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 5.3.1 and < 4.23.1 contain a denial of service caused by improper validation of identityPublicKey curve in LoginPacket, letting attackers crash the server by triggering exceptions during ECDH key derivation, exploit requires sending crafted LoginPackets.

  • 7.1 /10 High
    CVE-2026-86819 Auth required

    Waves Central - Privilege Escalation

    Waves Central for macOS contains a local privilege escalation caused by improper code-signing certificate validation in the privileged helper service, letting local authenticated users execute code with root privileges, exploit requires local authentication.

  • 7.3 /10 High
    CVE-2026-86810 No auth

    Open-Web-Analytics - Authentication Bypass

    Open-Web-Analytics <= 1.9.1 contains an authentication bypass caused by improper authentication in checkCapabilityAndAuthenticateUser function in Controller, letting remote attackers bypass authentication, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-86808 No auth

    moltis-org moltis - Authentication Bypass

    moltis-org moltis <= 20260818.10 contains a broken authentication caused by manipulation in vault_unlock_handler/vault_recovery_handler in vault.rs, letting remote attackers bypass authentication, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-86806 No auth

    opengeos GeoLibre - Server-Side Request Forgery

    opengeos GeoLibre <= 2.3.0 contains a server-side request forgery caused by manipulation in the _is_within_roots function, letting remote attackers make arbitrary server requests, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-86716 No auth

    Cesanta mJS - Buffer Overflow

    Cesanta mJS <= 1.26 contains a heap-based buffer overflow caused by improper handling in skip_spaces_and_comments function in src/mjs_tok.c, letting remote attackers cause memory corruption, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-86673 No auth

    ningzichun Student Management System - Hardcoded Credentials

    ningzichun Student Management System contains hardcoded credentials caused by manipulation in mysqli_connect function in config/database.php, letting remote attackers access sensitive credentials, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-86669 No auth

    aircheng-org iWebShop-5 - Authentication Bypass

    aircheng-org iWebShop-5 <= 5.15 contains an authentication bypass caused by manipulation of the "Name" argument in controllers/systemseller.php Login function, letting remote attackers bypass authentication, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-86083 Auth required

    n8n - Server-Side Template Injection

    n8n < 1.123.76, 2.37.7, 2.38.2 contains a server-side template injection caused by mutable global JSON.stringify usage in legacy expression engine, letting attackers execute arbitrary code, exploit requires expression injection.

  • 8.8 /10 High
    CVE-2026-86076 Auth required

    n8n - Server-Side Template Injection

    n8n < 1.123.76, 2.37.7, 2.38.2 contains a server-side template injection caused by improper sanitizer rebinding via reserved class member __sanitize in PrototypeSanitizer, letting attackers execute backend code and editor-preview JavaScript, exploit requires crafted expression with reserved class member.

  • 7.5 /10 High
    CVE-2026-86075 No auth

    n8n - Denial of Service

    n8n < 2.37.7 and < 2.38.2 contains a denial of service caused by lack of size validation on client_name and grant_types in OAuth Dynamic Client Registration endpoint, letting unauthenticated remote attackers exhaust database storage by persisting oversized values.

  • 7.1 /10 High
    CVE-2026-86074 No auth

    n8n - Server Side Request Forgery

    n8n < 2.37.7 and < 2.38.2 contains a server-side request forgery caused by lack of origin validation in Instance AI credential setup flow, letting attackers cause authenticated requests or redirects to other origins, exploit requires user to inject attacker-controlled URL.