Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 13 of 677
- 8.7 /10 HighCVE-2026-39993 Auth required
Download Station - Path Traversal
Download Station contains a path traversal caused by improper validation of file paths, letting remote attackers with user accounts read unexpected files or system data, exploit requires user authentication.
- 7.3 /10 HighCVE-2026-3712 No auth
PhastPress WordPress Plugin - Server-Side Request Forgery
PhastPress WordPress plugin <= 3.10 contains a server-side request forgery caused by dynamic URL whitelist construction from attacker-controlled HTTP 'Host' header, letting unauthenticated attackers make arbitrary HTTP requests.
- 8.2 /10 HighCVE-2026-35088 No auth
Slican Telephone Exchanges - Information Disclosure
Slican telephone exchanges use symmetric encryption with hardcoded secret keys in multiple binaries, letting attackers with file access decrypt communication, exploit requires access to binary files.
- 8.7 /10 HighCVE-2026-34015 Auth required
Video Station - Path Traversal
Video Station < 5.8.8 contains a path traversal caused by improper input validation, letting remote attackers with user accounts read arbitrary files, exploit requires user authentication.
- 8.4 /10 HighCVE-2026-34014 Auth required
Download Station - Broken Access Control
Download Station contains an incorrect permission assignment vulnerability affecting critical resources, letting local attackers with administrator accounts compromise system security, exploit requires administrator privileges.
- 8.4 /10 HighCVE-2026-34009 Auth required
Notes Station 3 - Broken Access Control
Notes Station 3 contains a broken access control vulnerability caused by improper isolation or compartmentalization, letting local attackers with administrator privileges compromise system security, exploit requires administrator access.
- 8.5 /10 HighCVE-2026-34008 Auth required
Notes Station 3 - Broken Access Control
Notes Station 3 contains a broken access control vulnerability caused by incorrect permission assignment for critical resources, letting local attackers with user accounts compromise system security, exploit requires local user account.
- 9.3 /10 CriticalCVE-2026-34006 No auth
sMedio DTCP MOVE - Authentication Bypass
sMedio DTCP MOVE < 1.4.5 contains a broken authentication caused by missing authentication for critical functions, letting remote attackers gain unauthorized access, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-26245 Auth required
Video Station - SQL Injection
Video Station < 5.8.8 contains a SQL injection caused by improper sanitization of user input, letting remote attackers with user accounts execute unauthorized commands, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-26244 Auth required
Video Station - SQL Injection
Video Station < 5.8.8 contains a SQL injection caused by improper sanitization of user input, letting remote attackers with user accounts execute unauthorized commands, exploit requires user authentication.
- 7.2 /10 HighCVE-2026-26243 Auth required
Qsync Central - Path Traversal
Qsync Central < 5.0.0.6, < 5.1.0.2, < 5.2.0.4 contains a path traversal caused by insufficient input validation, letting remote attackers with user accounts read arbitrary files.
- 9.3 /10 CriticalCVE-2026-19863 No auth
EthereumAuthenticator - Authentication Bypass
EthereumAuthenticator contains an authentication bypass caused by unanchored substring matching of the login path, letting unauthenticated clients access protected resources, exploit requires the protected path to contain the login path as a later segment.
- 8.8 /10 HighCVE-2026-18661 No auth
Eclipse Jetty - Broken Access Control
Eclipse Jetty jetty-annotations and jetty-eeN-annotations contain a broken access control caused by incorrect application of Jakarta Spec url-pattern rules when mixed @ServletSecurity and web.xml security-constraints exist, letting attackers bypass security constraints on some url-patterns, exploit requires specific web.xml configuration with multiple url-patterns.
- 8.8 /10 HighCVE-2026-18660 No auth
Eclipse Jetty - Broken Access Control
Eclipse Jetty jetty-server and jetty-proxy contain a broken access control caused by case-sensitive host whitelist/blacklist, letting attackers bypass host restrictions by using case variations, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-18586 No auth
Premium Packages – Sell Digital Products Securely - Stored XSS
Premium Packages – Sell Digital Products Securely WordPress plugin <= 7.0.5 contains a stored XSS caused by insufficient sanitization and escaping of 'order_email', letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.