Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 12 of 677

  • 7.5 /10 High
    CVE-2026-76066 No auth

    IntentKit - Authorization Bypass

    IntentKit <= 2.6.3 contains an authorization bypass caused by executor validating tool calls against the full tool registry instead of per-request narrowed tool advertisement, letting unauthenticated attackers execute owner-only state-changing tools without approval, exploit requires supplying exact de-advertised tool name and arguments.

  • 7.1 /10 High
    CVE-2026-74920 No auth

    Document Gallery WordPress - Reflected XSS

    Document Gallery WordPress plugin <= 5.1.1 contains a reflected XSS caused by improper sanitization and escaping of user input in an unauthenticated AJAX action, letting attackers execute scripts in visitors' browsers, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-73799 No auth

    HPE NonStop SNMP Trap Multiplexer - Memory Corruption

    HPE NonStop SNMP Trap Multiplexer contains a memory corruption vulnerability, letting attackers potentially cause system instability or execute arbitrary code, exploit requires unspecified conditions.

  • 8.2 /10 High
    CVE-2026-63315 No auth

    Slican IPx - Information Disclosure

    Slican IPx telephone exchanges before 6.62.0100 contain an information disclosure vulnerability caused by storing temporary subscriber passwords in plaintext, letting attackers with database access obtain user passwords and log in, exploit requires database access.

  • 8.7 /10 High
    CVE-2026-63314 Auth required

    Slican IPx - SQL Injection

    Slican IPx telephone exchanges < 6.62.0100 contain a SQL injection caused by improper neutralization of input in /webcti/admin_json.php endpoint, letting authenticated attackers execute SQL injection attacks.

  • 8.7 /10 High
    CVE-2026-53882 Auth required

    Virtualization Station - Broken Access Control

    Virtualization Station < 4.1.1.130 contains a broken access control vulnerability caused by improper link resolution before file access, letting remote attackers with user accounts compromise system security, exploit requires user authentication.

  • 7.6 /10 High
    CVE-2026-53574 Auth required

    EspoCRM - SQL Injection

    EspoCRM 8.1.0 to < 9.3.8 contains a SQL injection caused by crafted 'where' parameter in GET entity streamAttachments endpoint, letting authenticated non-administrators extract database info and escalate privileges.

  • 9.3 /10 Critical
    CVE-2026-50619 No auth

    Qsirch - Path Traversal

    Qsirch contains a path traversal vulnerability caused by improper input validation, letting remote attackers read arbitrary files, exploit requires no special privileges.

  • 9.4 /10 Critical
    CVE-2026-50612 Auth required

    QuMagie - Privilege Escalation

    QuMagie < 2.9.2 contains a symbolic link following vulnerability caused by improper handling of symlinks, letting remote attackers with user accounts compromise system security, exploit requires attacker to have a user account.

  • 9.3 /10 Critical
    CVE-2026-47786 No auth

    HybridDesk Station - Command Injection

    HybridDesk Station contains a command injection caused by unsanitized input, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-47168 Auth required

    EspoCRM - Insecure Deserialization

    EspoCRM < 9.3.7 contains an insecure deserialization vulnerability caused by unrestricted deserialization of crafted serialized PHP objects in MassAction or Export parameters, letting authenticated administrators execute arbitrary code on the server.

  • 8.7 /10 High
    CVE-2026-44084 No auth

    Video Station - Authorization Bypass

    Video Station < 5.8.8 contains an authorization bypass caused by user-controlled key, letting remote attackers obtain sensitive data, exploit requires no special privileges.

  • 8.6 /10 High
    CVE-2026-41545 Auth required

    QuMagie - Path Traversal

    QuMagie < 2.9.1 contains a path traversal caused by improper validation of file paths, letting remote attackers with administrator privileges read arbitrary files, exploit requires administrator account.

  • 8.7 /10 High
    CVE-2026-41544 Auth required

    QcalAgent - Path Traversal

    QcalAgent < 1.1.10 contains a path traversal caused by insufficient validation of file paths, letting remote attackers with user accounts read arbitrary files, exploit requires user authentication.

  • 8.9 /10 High
    CVE-2026-39997 No auth

    HybridDesk Station - Authentication Bypass

    HybridDesk Station < 4.2.22 contains a broken authentication caused by missing authentication for critical functions, letting remote attackers gain unauthorized access, exploit requires no special privileges.