Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 21 of 677

  • 7.5 /10 High
    CVE-2026-89071 Auth required

    Progress MOVEit Transfer - LDAP Injection

    Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an LDAP injection caused by improper neutralization of special elements in LDAP queries, letting attackers manipulate LDAP queries remotely, exploit requires crafted LDAP input.

  • 7.5 /10 High
    CVE-2026-89070 No auth

    Progress MOVEit Transfer - Authentication Bypass

    Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an authentication bypass caused by capture-replay vulnerability in the OIDC module, letting attackers bypass authentication, exploit requires replaying captured authentication tokens.

  • 8.0 /10 High
    CVE-2026-89069 Auth required

    Progress MOVEit Transfer - Stored XSS

    Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4 contains a stored XSS caused by improper neutralization of input during web page generation in the Ad Hoc module, letting attackers execute scripts, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-89068 No auth

    Progress MOVEit Transfer - Authentication Bypass

    Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 < 2026.0.4 contains a broken authentication caused by a missing critical step in the LDAP module, letting attackers bypass authentication, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-89067 Auth required

    Progress MOVEit Transfer - Authentication Bypass

    Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an authentication bypass caused by use of alternate path or channel, letting attackers bypass authentication, exploit requires crafted request.

  • 7.2 /10 High
    CVE-2026-88829 No auth

    BusyBox httpd - Path Traversal

    BusyBox httpd contains a path traversal caused by improper path rewriting in reverse proxy feature, letting remote attackers access arbitrary backend paths, exploit requires crafted pipelined HTTP requests.

  • 8.8 /10 High
    CVE-2026-88164 Auth required

    Microsoft Office SharePoint - Privilege Escalation

    Microsoft Office SharePoint contains a broken access control caused by missing authorization checks, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 9.8 /10 Critical
    CVE-2026-87855 No auth

    JTL-Connector for WooCommerce - Unrestricted File Upload

    JTL-Connector for WooCommerce WordPress plugin <= 2.4.3 contains an arbitrary file upload vulnerability caused by insufficient file type validation and improper authentication in saveImage(), letting unauthenticated attackers upload executable files and achieve remote code execution.

  • 8.8 /10 High
    CVE-2026-87093 Auth required

    Progress MOVEit Transfer - Broken Access Control

    Progress MOVEit Transfer < 2025.1.6 and 2026.0.0 < 2026.0.4 contains an incorrect permission assignment for critical resource, letting attackers gain unauthorized access, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-86848 Auth required

    DPDK lib/vhost - Out of Bounds Read/Write

    DPDK lib/vhost vhost-crypto contains an out-of-bounds access caused by indirect-descriptor snapshot double-fetching a guest descriptor next index, letting malicious guests cause memory corruption, exploit requires malicious guest access.

  • 8.8 /10 High
    CVE-2026-86799 No auth

    Forms WordPress - Stored XSS

    Forms WordPress plugin < 3.0.2 contains a stored XSS caused by lack of sanitization and escaping of submitted form values, letting unauthenticated attackers execute arbitrary scripts in admin dashboard, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-86787 Auth required

    Affiliate-Toolkit WordPress plugin - Remote Code Execution

    Affiliate-Toolkit WordPress plugin < 3.9.1 contains a remote code execution caused by insufficient template body validation in its templating engine, letting users with Contributor role or above execute arbitrary PHP code on the server, exploit requires Contributor or higher privileges.

  • 8.8 /10 High
    CVE-2026-86567 Auth required

    DPDK lib/vhost - Use After Free

    DPDK lib/vhost contains a use-after-free vulnerability caused by failure to invalidate vring pointers when the IOTLB is invalidated, letting attackers cause memory corruption, exploit requires no special conditions.

  • 8.2 /10 High
    CVE-2026-86565 Auth required

    DPDK - Out of Bounds Read/Write

    DPDK lib/vhost contains an out-of-bounds write caused by desynchronization of virtqueue size from inflight descriptor table size, letting guest attackers corrupt host memory, exploit requires guest access.

  • 7.8 /10 High
    CVE-2026-86563 Auth required

    DPDK lib/vhost - Memory Corruption

    DPDK lib/vhost contains a memory corruption caused by a double-offset bug in vhost log mapping calculation, letting attackers cause incorrect memory access, exploit requires no special conditions.