Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 14 of 891

  • 8.3 /10 High
    CVE-2026-84170 No auth

    Apache Wicket - Denial of Service

    Apache Wicket 9.14.0 to 9.24.0 and 10.0.0 to 10.9.1 contain an unrestricted resource allocation vulnerability caused by unbounded upload size parameters in AbstractFileUploadResource, letting unauthenticated attackers exhaust server disk or memory, exploit requires deliberate mounting of the vulnerable upload resource.

  • 8.3 /10 High
    CVE-2026-83594 No auth

    Apache Wicket - Denial of Service

    Apache Wicket 9.14.0 to 9.24.0 and 10.0.0 to 10.11.0 contain a denial of service caused by excessive memory allocation from unvalidated file size in FileUploadToResourceField callback, letting attackers exhaust server heap remotely without authentication, exploit requires calling UploadInfo#get().

  • 7.4 /10 High
    CVE-2026-83559 No auth

    Apache Wicket - Stored XSS

    Apache Wicket 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 contain a stored XSS caused by improper escaping of backslashes in JavaScript string literals in JavaScriptUtils#escapeQuotes(), letting attackers execute arbitrary JavaScript in user sessions, exploit requires attacker-controlled input in validation messages or similar.

  • 7.4 /10 High
    CVE-2026-83539 No auth

    Apache Wicket - Stored XSS

    Apache Wicket 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 contain a stored XSS caused by improper neutralization of input in SmartLinkLabel and SmartLinkMultiLineLabel components, letting attackers execute script via crafted URLs, exploit requires user to activate the malicious link.

  • 7.6 /10 High
    CVE-2026-82956 No auth

    Apache Wicket - Stored XSS

    Apache Wicket 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 contain a stored XSS caused by improper neutralization of client-supplied windowName parameter in AjaxNewWindowNotifyingBehavior, letting attackers execute script in the application's origin, exploit requires explicit use of AjaxNewWindowNotifyingBehavior.

  • 7.2 /10 High
    CVE-2026-82840

    Apache Wicket - Authentication Bypass

    Apache Wicket 8.18.0-8.19.0, 9.23.0-9.24.0, and 10.9.0-10.11.0 contain a session fixation vulnerability caused by failure to renew session ID on re-authentication in AuthenticatedWebSession, letting attackers fixate sessions, exploit requires attacker to plant a session ID in victim's browser.

  • 7.1 /10 High
    CVE-2026-66570 No auth

    Nickboss WordPress File Upload - Stored XSS

    Nickboss WordPress File Upload <= 5.2.1 contains a stored XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted input upload.

  • 9.3 /10 Critical
    CVE-2026-62048 No auth

    Liquid Web / StellarWP BookIt - SQL Injection

    Liquid Web / StellarWP BookIt <= 2.6.0.6 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.

  • 10.0 /10 Critical
    CVE-2026-120338 No auth

    Prefab UI - Unrestricted File Read & Write and Remote Code Execution

    Prefab UI 0.14.0 through 0.20.2 contains a file system read and write vulnerability caused by unrestricted Deno permissions and exposed Deno API in the JavaScript global object, letting attackers with code execution read/write files as the server OS user and persist code execution, exploit requires ability to supply code to the sandbox.

  • 9.9 /10 Critical
    CVE-2026-120308 Auth required

    Beta9 - Path Traversal

    Beta9 contains a path traversal caused by improper validation of volume identifiers in the gateway and worker components, letting tenants with workspace tokens read and write arbitrary files on the worker filesystem, exploit requires valid workspace token.

  • 9.9 /10 Critical
    CVE-2026-120307 Auth required

    Beta9 Worker - Broken Access Control

    Beta9 worker before 0.1.756 contains a broken access control vulnerability caused by improper path resolution in sandbox file API, letting tenants with workspace tokens read, write, list, and delete files on the host as root, exploit requires tenant to have a workspace token and running sandbox.

  • 9.9 /10 Critical
    CVE-2026-120306 Auth required

    Beta9 - Privilege Escalation

    Beta9 worker < 0.1.756 contains a privilege escalation caused by Buildah RUN steps executing with shared namespaces and CAP_DAC_OVERRIDE, letting tenant users escalate privileges by accessing the worker container filesystem, exploit requires tenant workspace token.

  • 7.5 /10 High
    CVE-2026-120241 No auth

    Ruijie RG-ES Series - Buffer Overflow

    Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P ESW_1.0(1)B1P48 contain a buffer overflow caused by manipulation of an unknown function in httpupg.cgi Local Firmware Upgrade Interface, letting remote attackers execute arbitrary code, exploit requires remote access.

  • 9.9 /10 Critical
    CVE-2026-120240 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B V260403_2.0.0 contains a command injection caused by manipulation of group_id/group_name argument in /bin/ioos WireGuard CLI Group Handler, letting remote attackers execute OS commands remotely, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-120239 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B V260403_2.0.0 contains a command injection caused by manipulation of the "file_id" argument in /bin/ioos WireGuard CLI Handler, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.