Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 265 of 695

  • 9.8 /10 Critical
    CVE-2026-104070 No auth

    SPIP Crayons - Broken Access Control

    Crayons plugin for SPIP < 3.5.0 contains a missing authorization vulnerability caused by omission of the secu_ anti-forgery parameter in crayons_store.php, letting unauthenticated attackers modify editable object fields and execute arbitrary PHP code, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-104069 Auth required

    HortusFox - Remote Code Execution

    HortusFox < 6.2 contains a remote code execution caused by insecure extraction of uploaded ZIP archives in ThemeModule::startImport(), letting authenticated administrators execute arbitrary OS commands as the web-server user, exploit requires administrator authentication.

  • 7.5 /10 High
    CVE-2026-103831

    TrueLayer Magento 2 Plugin - Insecure Deserialization

    TrueLayer Magento 2 Plugin contains an insecure deserialization vulnerability in Psr16CacheAdapter caused by unrestricted use of PHP's unserialize() on cached data, letting attackers with cache write access execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-103670 No auth

    Gitea - Broken Access Control

    Gitea contains a broken access control vulnerability caused by improper concurrency group run cancellation logic in Actions, letting fork pull request users cancel trusted in-progress runs without approval, exploit requires fork pull request creation.

  • 8.1 /10 High
    CVE-2026-103504 Auth required

    Organization Team API - Broken Access Control

    An organization team's permission change via API with only the 'permission' field does not rebuild per-unit access, letting organization owners unintentionally retain higher access levels, exploit requires organization owner privileges.

  • 7.1 /10 High
    CVE-2026-103346 No auth

    Tomlister Payflex Payment Gateway - Reflected XSS

    Tomlister Payflex Payment Gateway <= 2.7.1 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted request.

  • 9.1 /10 Critical
    CVE-2026-103059

    Gitea - Authentication Bypass

    Gitea contains a broken authentication caused by case-insensitive SQL LIKE comparison of SSH public keys, letting attackers with derived private keys authenticate as other users, exploit requires SSH server enabled.

  • 7.1 /10 High
    CVE-2026-103009 Auth required

    Elasticsearch - Authorization Bypass

    Elasticsearch contains an authorization bypass caused by inconsistent shard identifier validation in cross-cluster search requests using Remote Cluster Security 2.0, letting attackers with cross-cluster API keys access unauthorized index data, exploit requires crafted cross-cluster search requests with mismatched shard identifiers.

  • 7.2 /10 High
    CVE-2026-103007 Auth required

    Elasticsearch - Broken Access Control

    Elasticsearch contains an incorrect authorization vulnerability caused by improper enforcement of delegated administrative privilege scope during authorization checks, letting delegated users escalate privileges to access restricted indices, exploit requires delegated role-management privilege.

  • 8.5 /10 High
    CVE-2026-102915 Auth required

    WPO365 - Broken Access Control

    WPO365 <= 44.1 contains a broken access control vulnerability caused by improper authorization checks, letting attackers access or modify restricted subscriber data, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-102406 Auth required

    Kibana - Authorization Bypass

    Kibana contains an authorization bypass through user-controlled key caused by improper verification of data stream ownership in Fleet package installation, letting attackers with delegated Fleet package-management privileges intercept and modify cross-tenant data streams, exploit requires delegated Fleet package-management privileges without Elasticsearch admin rights.

  • 7.5 /10 High
    CVE-2026-102387 No auth

    Xserver Migrator - Sensitive Data Exposure

    Xserver Migrator <= 1.6.6 contains an unauthenticated sensitive data exposure vulnerability, letting unauthenticated attackers access sensitive information remotely, exploit requires no authentication.

  • 9.6 /10 Critical
    CVE-2026-102322 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 155.0.8059.39 contains an incorrect authorization vulnerability in SiteIsolation, letting remote attackers execute arbitrary code via crafted HTML pages, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-102167

    Arista Wi-Fi access points - Remote Code Execution & Denial of Service

    Arista Wi-Fi access points contain a memory corruption vulnerability in wired uplink network endpoints, letting unauthenticated attackers crash the sensor service or achieve remote code execution, exploit requires attacker on same network segment.

  • 7.5 /10 High
    CVE-2026-102165

    Arista Wi-Fi - Remote Code Execution

    Arista Wi-Fi access points contain a remote code execution caused by crafted packets sent to the capture service in a non-default streaming mode, letting unauthenticated attackers with network access execute code remotely, exploit requires non-default streaming mode.