Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 215 of 695
- 8.0 /10 HighCVE-2026-5048 Auth required
Brocade SANnav - SQL Injection
Brocade SANnav < 3.0.0a contains an SQL injection caused by improper sanitization of REST API query parameters, letting authenticated attackers inject malicious data.
- 7.1 /10 HighCVE-2026-50054 Auth required
Zimbra Collaboration Suite - Authorization Bypass
Zimbra Collaboration Suite contains an authorization flaw in GrantRightsRequest, letting authenticated attackers grant loginAs rights to other local accounts, enabling persistent mailbox access and mail-sending authority.
- 7.5 /10 HighCVE-2026-44031 No auth
OFFIS DCMTK - Denial of Service
OFFIS DCMTK 3.7.0 contains a denial of service caused by uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() when parsing deeply nested DICOM sequences, letting remote unauthenticated attackers crash the process via crafted datasets.
- 7.1 /10 HighCVE-2026-40804 No auth
Kodezen LLC aBlocks - Reflected XSS
Kodezen LLC aBlocks <= 2.16.0 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted input.
- 8.1 /10 HighCVE-2026-19494 Auth required
IBM Security Verify Access & IBM Verify Identity Access - Authentication Bypass
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an authentication bypass caused by improper authentication, letting remote authenticated attackers bypass security restrictions.
- 7.5 /10 HighCVE-2026-19493 No auth
IBM Security Verify Access & IBM Verify Identity Access - Path Traversal
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a path traversal vulnerability caused by improper input validation, letting remote attackers perform arbitrary file write.
- 9.1 /10 CriticalCVE-2026-19491 No auth
IBM Security Verify Access & IBM Verify Identity Access - Authentication Bypass
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an authentication bypass caused by improper authentication, letting remote attackers bypass authentication, exploit requires network access.
- 8.8 /10 HighCVE-2026-19482 Auth required
IBM Security Verify Access & IBM Verify Identity Access - Command Injection
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a command injection caused by improper neutralization of command arguments, letting remote authenticated attackers execute arbitrary commands.
- 9.1 /10 CriticalCVE-2026-19218 No auth
AKIN Software MyRezzta - Broken Authentication
AKIN Software MyRezzta 2.06.03 before 2.07.01 contains a weak password recovery mechanism caused by insecure password reset process, letting attackers exploit password recovery to gain unauthorized access, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-19083 Auth required
AKIN Software OctoCloud - Authorization Bypass
AKIN Software OctoCloud >= 1.12.06 < 1.12.07 contains an authorization bypass caused by user-controlled key vulnerability, letting attackers access functionality not properly constrained by ACLs, exploit requires crafted requests.
- 8.8 /10 HighCVE-2026-18740 Auth required
IBM Security Verify Access & IBM Verify Identity Access - Broken Access Control
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an argument injection vulnerability in unspecified components, letting remote authenticated attackers perform unauthorized actions.
- 9.1 /10 CriticalCVE-2026-17609 No auth
WordPress Super Forms – Drag & Drop Form Builder - Arbitrary Directory Deletion
Super Forms – Drag & Drop Form Builder plugin for WordPress <= 6.3.316 contains an arbitrary directory deletion vulnerability caused by insufficient validation of JSON field declarations and a bypassable ABSPATH guard in submit_form, letting unauthenticated attackers recursively delete arbitrary directories, exploit requires 'Delete files from server after form submissions' setting enabled by admin.
- 8.8 /10 HighCVE-2026-17196 Auth required
Super Forms – Drag & Drop Form Builder - Unrestricted File Upload
Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains an unrestricted file type upload caused by missing file type validation in upload_files function, letting authenticated attackers with Subscriber-level access upload executable files, exploit requires poisoning _super_elements post meta via super_save_form AJAX handler.
- 8.2 /10 HighCVE-2026-17189 No auth
IBM Security Verify Access & IBM Verify Identity Access - Stored XSS
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a stored XSS vulnerability caused by improper input sanitization in the Web UI, letting unauthenticated attackers embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session.
- 9.1 /10 CriticalCVE-2026-16916 Auth required
IBM Security Verify Access - Remote Code Execution
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a remote code execution caused by a protection mechanism failure, letting remote authenticated attackers execute arbitrary code.