Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 226 of 695

  • 9.1 /10 Critical
    CVE-2026-92414 No auth

    Apache Jackrabbit - Authentication Bypass

    Apache Jackrabbit 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5 contain a session fixation vulnerability caused by attaching cached authenticated sessions on token matches without credential checks, letting attackers reuse sessions across users, exploit requires crafted token headers.

  • 7.2 /10 High
    CVE-2026-89417

    OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. - Stored XSS

    OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin <= 6.3.10 contains a stored XSS caused by insufficient input sanitization and output escaping in 's' Search Parameter via comments-atom Feed, letting unauthenticated attackers execute arbitrary scripts, exploit requires front-end server serving .tmp files without proper Content-Type headers.

  • 7.2 /10 High
    CVE-2026-89322 Auth required

    Vault - Broken Access Control

    Vault and Vault Enterprise < 2.1.2, 1.21.12, 1.20.17, 1.19.23 contain a broken access control caused by inconsistent evaluation of ACL policies against canonical resource and policy names, letting authenticated users bypass explicit deny restrictions and escalate privileges, exploit requires delegated permissions.

  • 8.8 /10 High
    CVE-2026-88962 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution caused by improper control of code generation, letting remote authenticated attackers execute arbitrary code.

  • 7.1 /10 High
    CVE-2026-87971 No auth

    If-So Dynamic Content WordPress plugin - Stored XSS

    If-So Dynamic Content WordPress plugin < 1.10.2 contains a stored XSS caused by lack of URL scheme validation in admin page links, letting attackers execute arbitrary JavaScript in logged-in users' browsers, exploit requires user to be logged in.

  • 8.8 /10 High
    CVE-2026-87782 Auth required

    Koinonia Link WordPress - Broken Access Control

    Koinonia Link WordPress plugin < 1.1.5 contains a broken access control vulnerability caused by missing role change authorization checks, letting authenticated users escalate privileges to Administrator, exploit requires user authentication.

  • 8.8 /10 High
    CVE-2026-83742 Auth required

    wolfSSL wolfSSH - Integer Overflow

    wolfSSL wolfSSH v1.4.11 through v1.5.0 on non-Windows platforms contains an unsigned integer underflow in wstrncat() in src/port.c, letting authenticated remote attackers write one out-of-bounds null byte past a stack buffer by sending crafted SFTP paths, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-83540 Auth required

    wolfSSH - Broken Access Control

    wolfSSH Windows port 1.4.15 through 1.5.0 contains a broken access control caused by improper release of Windows logon tokens between connections, letting less privileged users escalate privileges by login poisoning, exploit requires valid user account.

  • 7.5 /10 High
    CVE-2026-82212 No auth

    Nexi XPay Build WordPress - Broken Access Control

    Nexi XPay Build WordPress plugin through 7.6.2 contains a broken access control caused by improper validation of security tokens on payment notification route, letting unauthenticated attackers mark orders as paid or failed, exploit requires no authentication.

  • 8.2 /10 High
    CVE-2026-82211 No auth

    Nexi XPay Build WordPress - Broken Access Control

    Nexi XPay Build WordPress plugin through 7.6.2 contains a broken access control vulnerability caused by lack of verification of payment results in unauthenticated routes, letting attackers mark orders as paid or failed, cancel orders, and obtain order keys exposing guest buyer details, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-81535 No auth

    wolfSSH - Authorization Bypass

    wolfSSH through 1.5.0 built with --enable-fwd contains an authorization bypass caused by missing checks on forwarded-tcpip channel opens in DoChannelOpen(), letting malicious SSH peers allocate unbounded buffers and open unauthorized forwarding channels, exploit requires SSH session with forwarding enabled.

  • 8.2 /10 High
    CVE-2026-77214 No auth

    libexpat - Out of Bounds Read

    libexpat before commit 13c5f63 contains a heap buffer over-read caused by improper validation of caller-supplied length in XML_ParseBuffer, letting attackers read out-of-bounds heap memory, exploit requires prior buffer allocation.

  • 9.8 /10 Critical
    CVE-2026-76501

    Cisco NX-OS - Remote Code Execution & Denial of Service

    Cisco NX-OS Software contains a remote code execution and denial of service vulnerability caused by improper input validation in the Segment Routing over IPv6 (SRv6) NGOAM feature, letting unauthenticated remote attackers execute arbitrary code with root privileges or cause device reloads, exploit requires NGOAM and SRv6 features enabled.

  • 9.8 /10 Critical
    CVE-2026-76500

    CVE-2026-76500

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp; The vulnerabilities tracked by CVE-2026-76500 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

  • 9.8 /10 Critical
    CVE-2026-76499

    CVE-2026-76499

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707. &nbsp;