Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 10 of 677
- 7.1 /10 HighCVE-2026-9703 Auth required
Grafana - Broken Access Control
Grafana contains a broken access control vulnerability in its data source proxy forwarding write requests to Loki data sources, letting authenticated Viewer users create, modify, and delete Loki alerting rules, affecting all users of the Loki data source.
- 7.5 /10 HighCVE-2026-96537 No auth
Tutor LMS - Broken Access Control
Tutor LMS WordPress plugin < 4.1.1 contains a broken access control vulnerability caused by missing capability checks in page regeneration routine, letting unauthenticated users force-publish, overwrite, create pages, and modify options.
- 8.6 /10 HighCVE-2026-93484 Auth required
Znuny - SQL Injection
Znuny through 7.3.6 contains a SQL injection caused by direct concatenation of unsanitized ContentSearch parameter in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB, letting attackers execute arbitrary SQL commands, exploit requires crafted input with ContentSearch parameter.
- 9.5 /10 CriticalCVE-2026-93483 No auth
Znuny - Authentication Bypass
Znuny through 7.3.6 contains an authentication bypass caused by trusting the attacker-controlled Remote-User HTTP header in HTTPBasicAuth modules, letting attackers impersonate any user including administrators without a password.
- 8.2 /10 HighCVE-2026-88794 No auth
Enterprise Architect - XML External Entity Injection
Enterprise Architect 17.1 contains an XML External Entity (XXE) injection caused by processing external entities in the XSLT Debugger when loading crafted XML files, letting attackers read arbitrary files, exploit requires crafted XML input.
- 7.2 /10 HighCVE-2026-88043 No auth
Mang Board WP - Stored XSS
Mang Board WP plugin for WordPress <= 2.4.0 contains a stored XSS caused by insufficient input sanitization and output escaping in the 'data_type' parameter, letting unauthenticated attackers execute arbitrary scripts on user page access.
- 8.8 /10 HighCVE-2026-81534 Auth required
Email Customizer for WooCommerce (Pro) - Remote Code Execution
Email Customizer for WooCommerce (Pro) <= 3.9.5 contains a remote code execution caused by insufficient authorization and input sanitization in send_test_mail() function, letting authenticated attackers with subscriber access execute arbitrary PHP code, exploit requires subscriber-level access.
- 7.3 /10 HighCVE-2026-79840 Auth required
HPE NonStop XABroker - Buffer Overflow
HPE NonStop XABroker contains a buffer overflow caused by improper memory handling, letting attackers cause memory corruption and application crash, exploit requires no special conditions.
- 7.3 /10 HighCVE-2026-79839 Auth required
HPE NonStop ODBC/MX Server - Buffer Overflow
HPE NonStop ODBC/MX Server contains a buffer overflow caused by improper memory handling, letting attackers cause memory corruption and application crash, exploit requires no special conditions.
- 7.3 /10 HighCVE-2026-79838 Auth required
HPE NonStop ODBC/MX Services - Buffer Overflow
HPE NonStop ODBC/MX Services contains a buffer overflow caused by improper memory handling, letting attackers cause memory corruption and application crash, exploit requires no special conditions.
- 7.3 /10 HighCVE-2026-79837 Auth required
HPE NonStop SQL/MX UDR SERVER - Denial of Service
HPE NonStop SQL/MX UDR SERVER contains a vulnerability caused by crafted messages that can cause process termination, service disruption, or memory corruption, letting attackers disrupt service, exploit requires crafted message.
- 7.4 /10 HighCVE-2026-79834 Auth required
HPE NonStop SQL/MX SQLCAT - Command Injection
HPE NonStop SQL/MX SQLCAT contains a command injection vulnerability allowing unauthenticated users to execute unauthorized commands remotely, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-79833 No auth
HPE NonStop ANSI SQLUTIL - Denial of Service
HPE NonStop ANSI SQLUTIL contains a denial of service vulnerability caused by unexpected service termination, letting remote unauthenticated attackers disrupt service availability, exploit requires no special privileges.
- 7.6 /10 HighCVE-2026-79832 Auth required
HPE NonStop SQL/MX Executor - Buffer Overflow
HPE NonStop SQL/MX Executor contains a stack buffer overflow caused by improper handling of input, letting attackers cause information disclosure or process crash, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-79829 No auth
HPE NonStop HTTP WEBSERVER - Denial of Service
HPE NonStop HTTP WEBSERVER contains a memory corruption vulnerability that may cause a system halt, letting attackers cause denial of service, exploit requires no special privileges.