Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 15 of 891

  • 9.9 /10 Critical
    CVE-2026-120238 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B 260403_2.0.0 contains a command injection caused by manipulation of the "file_id" argument in /bin/ioos ovpn_file Handler, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-120232 PoC publicAuth required

    Horizon DataSys Reboot Restore Standard - Memory Corruption

    Horizon DataSys Reboot Restore Standard <= 13.2 contains a memory corruption vulnerability caused by manipulation in sub_23908 function of shield.sys kernel driver, letting local attackers corrupt memory, exploit requires local access.

  • 9.9 /10 Critical
    CVE-2026-120231 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B V260403_2.0.0 contains a command injection caused by manipulation of the argument file_id in /bin/ioos OpenVPN CLI Handler, letting remote attackers execute arbitrary OS commands, exploit requires remote access.

  • 9.9 /10 Critical
    CVE-2026-120230 Auth required

    WAVLINK WN701AE - Command Injection

    WAVLINK WN701AE 260105 contains a command injection caused by manipulation of the "vlan_name" argument in del_vlan_group of ioos Web Backend, letting remote attackers execute arbitrary OS commands, exploit requires crafted request.

  • 9.1 /10 Critical
    CVE-2026-120229 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B 260403_2.0.0 contains a command injection caused by manipulation of the "file_id" argument in /bin/ioos, letting remote attackers execute arbitrary OS commands, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-120228 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B V260403_2.0.0 contains a command injection caused by manipulation of group_id/group_name arguments in /bin/ioos ioos Service, letting remote attackers execute arbitrary OS commands, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-120227 Auth required

    WAVLINK WN701AE - Command Injection

    WAVLINK WN701AE M01AE_V260105 contains a command injection caused by manipulation of the "rule_name" argument in del_staticrule function of static_route_setting.sh in ioos Web Backend, letting remote attackers execute arbitrary OS commands.

  • 9.1 /10 Critical
    CVE-2026-120225 Auth required

    Oray Pugongying X5 Pro - Path Traversal

    Oray Pugongying X5 Pro <= 7.6.1 contains a path traversal caused by manipulation of the "filename" argument in config_restore_ex function of /etc/openwrt_release, letting remote attackers access arbitrary files, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-120224 Auth required

    Oray Pugongying X5 Pro - Broken Access Control

    Oray Pugongying X5 Pro <= 7.6.1 contains an improper authorization vulnerability caused by manipulation in run_apis_by_json/run_async_task API Authorization component, letting remote attackers bypass authorization, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-120198 No auth

    WAVLINK WL-WN530BE1-A - Command Injection

    WAVLINK WL-WN530BE1-A V251117 contains a command injection caused by manipulation of the argument group_name/IP-FROM in con_check_read_finish function, letting remote attackers execute arbitrary commands, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-120197 Auth required

    WAVLINK WL-WN530HG4B - Command Injection

    WAVLINK WL-WN530HG4B M_V260724 contains a command injection caused by manipulation of the "Name" argument in /cgi-bin/wapi.cgi port_forward function, letting remote attackers execute arbitrary OS commands, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-120196 Auth required

    WAVLINK WN579X3-D - Command Injection

    WAVLINK WN579X3-D V250402 contains a command injection caused by manipulation of the "Name" argument in /cgi-bin/wapi.cgi port_forward function, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-120195 No auth

    WAVLINK WL-WN579A3-A - Command Injection

    WAVLINK WL-WN579A3-A 2026-03-10-94f93d4 contains a command injection caused by manipulation of the "wlan_ssid" argument in /cgi-bin/adm.cgi set_wzdgwMesh function, letting remote attackers execute arbitrary OS commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-120191 No auth

    Presenton - Authentication Bypass

    Presenton <= 0.9.11-beta contains a broken authentication caused by missing authentication in API component, letting remote attackers bypass authentication, exploit requires no special conditions.

  • 10.0 /10 Critical
    CVE-2026-120189 No auth

    D-Link DIR-505 - Buffer Overflow

    D-Link DIR-505 1.10B02 contains a stack-based buffer overflow caused by manipulation of the TFTP Upload Filename Handler in /usr/bin/tftpd, letting remote attackers execute arbitrary code, exploit requires remote access.