Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 19 of 677
- 8.2 /10 HighCVE-2026-94200 No auth
Erlang OTP ssl - Denial of Service
Erlang OTP ssl (tls_handshake_1_3, ssl_handshake, tls_client_ticket_store) < 11.2.12.14, 11.6.0.7, 11.7.8 contains a denial of service caused by improper validation of NewSessionTicket extensions, letting malicious TLS 1.3 servers crash ssl application on client nodes, exploit requires malicious TLS 1.3 server.
- 7.5 /10 HighCVE-2026-94197 No auth
F5 NGINX Kubernetes Ingress Controller - Authentication Bypass
F5 NGINX Kubernetes Ingress Controller contains an authentication and authorization bypass caused by unsanitized forwarding of client-supplied routing and method headers in the internal authentication subrequest, letting unauthenticated remote attackers access protected paths, exploit requires ExternalAuth policy or Ingress external authentication configuration.
- 7.2 /10 HighCVE-2026-93885 No auth
Cryptocurrency Donation Box – Bitcoin & Crypto Donations - Stored XSS
Cryptocurrency Donation Box – Bitcoin & Crypto Donations WordPress plugin <= 2.2.13 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in data_object parameter, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires nonce bypass via publicly exposed nonce.
- 8.1 /10 HighCVE-2026-93479 No auth
NGINX - Buffer Overflow
NGINX Plus and NGINX Open Source contain a heap buffer overflow caused by improper handling of regex capture variables in map directives with root or access log format referencing, letting unauthenticated attackers cause denial of service or code execution, exploit requires crafted HTTP requests under specific conditions.
- 9.8 /10 CriticalCVE-2026-93388 No auth
Printcart Store WooCommerce - Remote Code Execution
Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce <= 2.9.1 contains an unauthenticated arbitrary file upload vulnerability caused by improper validation of the gapi[name] parameter in nbdesigner_copy_image_from_url AJAX action, letting unauthenticated attackers upload and execute arbitrary PHP code remotely, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-92817 Auth required
Ignition Perspective - Broken Access Control
Ignition Perspective module contains a broken access control vulnerability caused by improper validation of session privileges, letting authenticated users with Vision project access escalate to Designer-level privileges and execute arbitrary code, exploit requires valid Vision session identifier.
- 8.1 /10 HighCVE-2026-92392 PoC publicNo auth
curl - Use After Free
curl contains a use after free vulnerability caused by mishandling HTTP/2 RST_STREAM frames with reason HTTP_1_1_REQUIRED or REFUSED_STREAM during upload, letting remote attackers cause memory corruption, exploit requires crafted server response.
- 7.2 /10 HighCVE-2026-92158 Auth required
F´ (F Prime) - Buffer Overflow
F´ (F Prime) < 4.2.0 contains a buffer overflow caused by integer wraparound in Svc::FpySequencer STORE directive stack write validation, letting attackers cause memory corruption, denial of service, or code execution, exploit requires crafted STORE directive with wrapped offset and size.
- 7.5 /10 HighCVE-2026-92155 No auth
F´ (F Prime) - Denial of Service
F´ (F Prime) < 4.2.0 contains a denial of service caused by invalid Type enum casting in Fw::FilePacket deserialization used by Svc::FileUplink, letting attackers crash or reset the application process, exploit requires crafted network file packet.
- 8.1 /10 HighCVE-2026-92154 Auth required
F´ (F Prime) - Data Tampering & Denial of Service
F´ (F Prime) < 4.2.0 contains a file integrity loss vulnerability caused by improper offset and size validation in Svc::FileUplink handleDataPacket, letting attackers write beyond declared upload size, exploit requires crafted file-uplink DATA packet.
- 7.1 /10 HighCVE-2026-92153 Auth required
F´ (F Prime) - Path Traversal
F´ (F Prime) < 4.3.0 contains a path traversal caused by lack of canonicalization in Svc::FileUplink destination path handling, letting attackers create or overwrite files at arbitrary writable locations, exploit requires ability to send file-uplink packets.
- 9.3 /10 CriticalCVE-2026-92152 No auth
F´ (F Prime) - Buffer Overflow
F´ (F Prime) 4.1.0 to 4.2.0 contains a buffer overflow caused by lack of range check on deserialized port field in Svc::GenericHub output-port dispatch, letting remote attackers cause heap corruption or remote code execution, exploit requires remote hub packet with out-of-bounds port index.
- 7.5 /10 HighCVE-2026-92151 No auth
F´ (F Prime) - Denial of Service
F´ (F Prime) < 4.2.0 contains a denial of service caused by improper handling of minimum packet-length in Svc::Ccsds::SpacePacketDeframer dataIn_handler, letting attackers cause process abort or reset, exploit requires sending short CCSDS telecommand frames.
- 7.5 /10 HighCVE-2026-92150 No auth
F´ (F Prime) - Denial of Service
F´ (F Prime) < 4.2.0 contains a denial of service caused by improper deserialization validation in Svc::GenericHub fromBufferDriver_handler, letting unauthenticated inter-processor peers abort or reset the process, exploit requires unauthenticated inter-processor hub peer to send malformed buffers.
- 9.1 /10 CriticalCVE-2026-92097 No auth
Click to Chat for WhatsApp - Template Injection
Click to Chat for WhatsApp WordPress plugin <= 4.44 contains an arbitrary shortcode execution vulnerability caused by unsanitized URL input passed to do_shortcode() in greetings templates, letting unauthenticated attackers execute arbitrary shortcodes.