Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

This feed covers the vulnerability. Panop covers your exposure to it.

How Panop validates exposure

CVE monitoring

  • The CVE, its CVSS score and the vendor's fix
  • Whether CISA has seen it exploited in the wild
  • Whether exploit code is public

Panop, in your environment

  • Whether you run the affected software, and where
  • Whether an attacker can actually reach and exploit it
  • The misconfigurations that never get a CVE number
  • What it would cost the business, ranked into what to fix first

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 1 of 891

  • 7.7 /10 High
    CVE-2026-77800

    ManageEngine Key Manager Plus - Authentication Bypass

    ManageEngine Key Manager Plus < 7151 contains a SAML authentication bypass caused by improper validation of SAML assertions, letting attackers log in using assertions meant for another service provider, exploit requires crafted SAML assertions.

  • 7.4 /10 High
    CVE-2026-77799 No auth

    ManageEngine Key Manager Plus - Authentication Bypass

    ManageEngine Key Manager Plus < 7150 contains a two-factor authentication bypass caused by improper verification code enforcement, letting attackers with valid credentials log in without a verification code, exploit requires valid credentials.

  • 8.8 /10 High
    CVE-2026-76955 No auth

    Zyxel NWA110AX - Privilege Escalation

    Zyxel NWA110AX firmware <= 7.12(ABTG.0)C0 contains a buffer overflow caused by improper handling in the zdp_wtp binary, letting LAN-based attackers escalate privileges, exploit requires LAN access.

  • 7.8 /10 High
    CVE-2026-120833 No auth

    labbench - Insecure Deserialization

    labbench before 0.46.1 contains an insecure deserialization vulnerability caused by untrusted .p or .pickle files passed to pandas.read_pickle in read() and read_relational(), letting attackers execute arbitrary code when loaded.

  • 7.4 /10 High
    CVE-2026-120830 No auth

    libslirp - Information Disclosure

    libslirp contains an out-of-bounds read caused by improper length handling in icmp_forward_error() when building ICMP error responses, letting attackers leak host memory via malformed IPv4 packets, exploit requires sending crafted packets.

  • 8.1 /10 High
    CVE-2026-120577 Auth required

    FluentCart WordPress Plugin - Arbitrary File Deletion

    FluentCart WordPress plugin <= 1.6.2 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in the deleteFile function, letting authenticated attackers with custom-level access delete arbitrary files, exploit requires authenticated user with custom-level access or higher.

  • 8.1 /10 High
    CVE-2026-120574 No auth

    SureCart WordPress Plugin - Authentication Bypass

    SureCart WordPress plugin <= 4.9.5 contains an unauthenticated account takeover caused by insecure passwordless one-time-code login REST route lacking rate limiting and lockout, letting unauthenticated attackers brute-force any user login including administrators.

  • 7.5 /10 High
    CVE-2026-120559 No auth

    Contact Form Extender for Divi Builder - Arbitrary File Deletion

    Contact Form Extender for Divi Builder plugin for WordPress <= 1.0.6 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in cfefd_remove_uploaded_file(), letting unauthenticated attackers delete arbitrary files, exploit requires nonce retrievable from public page source.

  • 7.2 /10 High
    CVE-2026-120558 Auth required

    Advanced Shipment Tracking for WooCommerce - SQL Injection

    Advanced Shipment Tracking for WooCommerce <= 3.9 contains an SQL injection caused by improper escaping of the 'tracking_provider' parameter in the REST endpoint, letting authenticated Shop Manager attackers extract sensitive database information.

  • 8.1 /10 High
    CVE-2026-120538 No auth

    Easy Digital Downloads - Authentication Bypass

    Easy Digital Downloads WordPress plugin <= 3.7.2 contains an authentication bypass caused by trusting guest checkout email as proof of identity, letting unauthenticated attackers take over administrator accounts via PayPal checkout flows.

  • 9.8 /10 Critical
    CVE-2026-120534

    Advanced Custom Fields Extended PRO - Code Injection

    Advanced Custom Fields: Extended PRO for WordPress <= 0.9.2.6 contains a limited code injection caused by insufficient validation of form configuration parameters in render_field, letting unauthenticated attackers call arbitrary WordPress functions, exploit requires shortcode_preview enabled or lack of OpenSSL.

  • 9.1 /10 Critical
    CVE-2026-120518

    BuddyPress XProfile Image Field - Arbitrary File Deletion

    BuddyPress XProfile Image Field plugin for WordPress <= 3.1.0 contains an arbitrary file deletion vulnerability caused by unsafe unlink() calls on visitor-supplied signup metadata, letting unauthenticated attackers delete arbitrary files, exploit requires open registration and image-type profile field on signup form.

  • 8.8 /10 High
    CVE-2026-107441 No auth

    Zyxel GS1900-24E - Command Injection

    Zyxel GS1900-24E firmware <= 2.90(AAHK.2)C0 contains a command injection caused by an out-of-bounds write in the CGI program, letting unauthenticated adjacent attackers execute OS commands via crafted HTTP requests.

  • 7.8 /10 High
    CVE-2026-99239 Auth required

    Linux Kernel Bluetooth L2CAP - Race Condition

    Linux kernel Bluetooth L2CAP contains a race condition caused by improper state checks and locking in __l2cap_chan_add and related functions, letting attackers cause inconsistent channel states, exploit requires concurrent operations.

  • 7.8 /10 High
    CVE-2026-99238 Auth required

    Linux Kernel - Use After Free

    Linux kernel contains a use-after-free vulnerability caused by missing trace_types_lock when updating modules in persistent tracing instances, letting attackers cause memory corruption or denial of service, exploit requires concurrent module load or unload.