Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 230 of 695

  • 7.6 /10 High
    CVE-2026-42714 Auth required

    Piggly Dev Pix por Piggly (para Woocommerce) - SQL Injection

    Piggly Dev Pix por Piggly (para Woocommerce) <= 2.1.2 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.

  • 7.6 /10 High
    CVE-2026-42713 Auth required

    Gopiplus Post title marquee scroll - SQL Injection

    Gopiplus Post title marquee scroll <= 9.9 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.

  • 7.6 /10 High
    CVE-2026-42710 Auth required

    10Web Slider - SQL Injection

    10Web Slider by 10Web <= 1.2.63 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.6 /10 High
    CVE-2026-42708 Auth required

    AF themes WP Post Author - SQL Injection

    AF themes WP Post Author <= 4.0.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-42618 Auth required

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_decompress() in compress.c, letting attackers corrupt heap memory by reading a specially crafted NTFS image, exploit requires crafted file access.

  • 7.1 /10 High
    CVE-2026-42617 Auth required

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in ntfs_ir_to_ib() in index.c, letting attackers corrupt heap memory via crafted NTFS images, exploit requires file creation in a directory.

  • 7.8 /10 High
    CVE-2026-42616 No auth

    NTFS-3G - Buffer Overflow

    NTFS-3G < 2026.7.7 contains a heap buffer overflow caused by improper handling in cat() function in ntfscat.c, letting attackers corrupt heap memory by reading a crafted malicious NTFS image, exploit requires crafted NTFS image.

  • 8.5 /10 High
    CVE-2026-34499

    Johnson Controls ADVMS - Hardcoded Credentials

    Johnson Controls ADVMS < 3.10 contains a hardcoded cryptographic key vulnerability caused by embedded keys in the executable, letting attackers read sensitive constants within the executable, exploit requires access to the executable.

  • 7.2 /10 High
    CVE-2026-20362 No auth

    Cisco Finesse - Server-Side Request Forgery

    Cisco Finesse contains a server-side request forgery caused by improper input validation in the web-based management interface, letting unauthenticated remote attackers obtain limited sensitive information, exploit requires crafted HTTP request.

  • 9.1 /10 Critical
    CVE-2026-20328 No auth

    Cisco License On-Prem - Authentication Bypass

    Cisco License On-Prem contains a broken authentication caused by improper checks during the password reset process, letting unauthenticated remote attackers reset arbitrary user passwords and gain unauthorized access, exploit requires sending a crafted request to the web interface.

  • 9.3 /10 Critical
    CVE-2026-19572 No auth

    FlexNet Publisher lmadmin - Authentication Bypass

    FlexNet Publisher lmadmin contains an authentication bypass caused by a hardcoded SOAP handler, letting unauthenticated attackers obtain privileged administrator sessions without valid credentials.

  • 7.7 /10 High
    CVE-2026-19396

    ASUS RT-BE57 Router - Authentication Bypass

    ASUS RT-BE57 router contains a predictable seed vulnerability in the PRNG used for IFTTT pairing token generation, letting unauthenticated nearby attackers derive tokens to read or modify router settings, exploit requires proximity to observe pairing session.

  • 9.3 /10 Critical
    CVE-2026-19386 Auth required

    ASUS Router - Buffer Overflow

    ASUS Router contains a stack-based buffer overflow caused by crafted configuration file upload exceeding buffer size, letting authenticated nearby attackers execute arbitrary code.

  • 8.1 /10 High
    CVE-2026-19186

    Zephyr IEEE802154 - Out-of-Bounds Read & Write

    Zephyr subsys/net/l2/ieee802154 contains an out-of-bounds read and write caused by improper length validation in ieee802154_decipher_data_frame(), letting remote attackers cause memory corruption and denial of service by sending crafted short frames, exploit requires enabled CONFIG_NET_L2_IEEE802154_SECURITY with crypto device and active security session.

  • 8.4 /10 High
    CVE-2026-16528 Auth required

    ASUS Router - Authentication Bypass

    ASUS routers contain an insertion of sensitive information into log files caused by improper logging of DDNS credentials, letting remote authenticated attackers obtain credentials and potentially modify DNS settings, exploit requires authentication.