Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 22 of 677

  • 7.8 /10 High
    CVE-2026-86562 Auth required

    DPDK lib/vhost - Buffer Overflow

    DPDK lib/vhost contains a heap buffer overflow caused by a TOCTOU double-fetch of control-queue descriptors in the VDUSE control-queue handler, letting attackers execute arbitrary code, exploit requires crafted control-queue descriptors.

  • 8.4 /10 High
    CVE-2026-86476 No auth

    gst-plugins-base - Buffer Overflow

    gst-plugins-base contains a heap buffer overflow caused by improper validation of GstVideoMeta plane strides and offsets during video buffer processing, letting local attackers cause denial of service or code execution via crafted IPC buffers.

  • 8.8 /10 High
    CVE-2026-86461 Auth required

    FV Flowplayer Video Player - Unrestricted File Upload

    FV Flowplayer Video Player WordPress plugin <= 7.5.54.7212 contains a limited arbitrary file upload vulnerability caused by incomplete file type validation in check_mimetype, letting authenticated attackers with subscriber access upload executable files, exploit requires 'profile videos on bio' option enabled.

  • 9.0 /10 Critical
    CVE-2026-86002 Auth required

    Dokku - Command Injection

    Dokku < 0.38.25 contains a command injection caused by unsafe evaluation of docker-options plugin strings in Bash eval, letting users with app-level access and SSH execute arbitrary commands with dokku user privileges.

  • 9.1 /10 Critical
    CVE-2026-85714 Auth required

    Stirling-PDF - Command Injection

    Stirling-PDF < 2.13.2 contains a command injection caused by insufficient SQL whitelist validation in DatabaseService.validateSqlContent(), letting authenticated administrators execute arbitrary OS commands via crafted SQL files, exploit requires admin authentication and default H2 database with security mode.

  • 7.3 /10 High
    CVE-2026-85298 Auth required

    Google Cloud Application Integration - Broken Access Control

    Google Cloud Application Integration < 2026-08-27 contains an incorrect authorization vulnerability caused by improper AuthConfig validation and integration execution runtime, letting authenticated users escalate privileges and impersonate service accounts, exploit requires user authentication.

  • 7.2 /10 High
    CVE-2026-84471 Auth required

    OpenVPN - Use After Free

    OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 contain a use-after-free caused by crafted packets during TLS session promotion or expiry, letting remote authenticated peers cause denial of service or memory leak.

  • 7.2 /10 High
    CVE-2026-83592 No auth

    Contact Form DB for Enfold - Stored XSS

    Contact Form DB for Enfold WordPress plugin <= 2.0.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in contact form field values, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.

  • 7.9 /10 High
    CVE-2026-82715 Auth required

    Hitachi Disk Array Driver - Insecure Temporary File

    Hitachi Disk Array Driver for AIX < 01-23-/A and Virtual I/O Server < 01-23-/A contain an insecure temporary file vulnerability caused by improper handling of temporary files, letting attackers potentially access or modify temporary files, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-82026 Auth required

    Radar - Broken Access Control

    Radar < 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) caused by reliance on runtime-mode check instead of role-based access control, letting authenticated or unauthenticated attackers execute privileged shell commands remotely, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-79957 Auth required

    ServiceNext - Broken Access Control

    ServiceNext contains an insecure direct object reference (IDOR) caused by lack of verification that the authenticated token matches the requested user ID in /api/Usuario/GetUsuarios, letting authenticated users access other users' full profiles including cleartext passwords, exploit requires authentication.

  • 7.5 /10 High
    CVE-2026-78193 No auth

    JTL-Connector for WooCommerce - SQL Injection

    JTL-Connector for WooCommerce plugin for WordPress <= 2.4.3 contains a time-based SQL injection caused by insufficient escaping of user-supplied parameters in the 'product.push' Identity Endpoint, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-77524 Auth required

    KEDA - Broken Access Control

    KEDA <= 2.20.2 contains a broken access control vulnerability caused by improper validation of hashiCorpVault.address in TriggerAuthentication and ScaledObject resources, letting namespace administrators escalate privileges to operator cluster-wide permissions, exploit requires namespace admin privileges.

  • 9.3 /10 Critical
    CVE-2026-77371 Auth required

    Redash - Authentication Bypass

    Redash 26.0.0 to 26.9.0 contains a broken authentication caused by DuckDB query runner enabling external access by default, letting users with query access read or write files and bypass authentication, exploit requires query access to DuckDB data source.

  • 7.2 /10 High
    CVE-2026-77114 No auth

    Document Gallery WordPress plugin - Stored XSS

    Document Gallery WordPress plugin <= 5.1.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'dg_thumber_webhook' action request body, letting unauthenticated attackers inject scripts that execute when users access injected pages, exploit requires logging enabled in plugin's Advanced settings.