Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 268 of 695

  • 9.3 /10 Critical
    CVE-2026-91107 Auth required

    openSIS Classic - Broken Access Control

    openSIS Classic 9.3 contains a broken access control vulnerability caused by improper authorization in the School Information update path, letting authenticated users with teacher role reset arbitrary staff passwords, exploit requires teacher role authentication.

  • 9.8 /10 Critical
    CVE-2026-88424 No auth

    FineAdmin - SQL Injection

    FineAdmin v1.0 contains a sql injection caused by unsanitized input in the field/order parameter at ButtonService.GetListByFilter(), letting attackers access sensitive database information via crafted SQL statements, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-88396 Auth required

    ApiAdmin - Remote Code Execution

    ApiAdmin <= 5.0 contains a directory traversal and unrestricted file upload vulnerability caused by lack of file extension validation in the admin file-upload endpoint, letting logged-in admin users execute remote code via uploaded PHP files.

  • 9.8 /10 Critical
    CVE-2026-88395 No auth

    GouGuOA - SQL Injection

    GouGuOA <= 6.0.5 contains a sql injection caused by unsanitized keywords parameter in /home/message/rubbish, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-88394 No auth

    WookTeam - Path Traversal

    WookTeam <= 1.6.6 contains a path traversal caused by lack of path normalization in /api/project/task/export endpoint, letting remote attackers download arbitrary files readable by the web server, exploit requires crafted JSON payload.

  • 9.8 /10 Critical
    CVE-2026-88393 No auth

    WookTeam - Remote Code Execution

    WookTeam <= 1.6.6 contains a remote code execution caused by unsafe eval of base64-decoded data parameter in /api/project/task/export, letting attackers execute arbitrary PHP code remotely, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-88392 No auth

    Unimall - Directory Traversal

    Unimall v4 contains a directory traversal caused by improper validation in FileUploadController.local(), letting attackers execute arbitrary code remotely, exploit requires crafted file upload.

  • 9.8 /10 Critical
    CVE-2026-88391 No auth

    Northstar - Remote Code Execution

    Northstar <= 9.1.1 contains a remote code execution caused by exposed H2 Console without authentication and default credentials, letting network-reachable attackers execute arbitrary system commands pre-authentication.

  • 8.4 /10 High
    CVE-2026-86671 Auth required

    Eclipse Che - Server Side Request Forgery

    Eclipse Che >= 7.29.0 contains a server-side request forgery caused by lack of scheme and host allow-list in URLFetcher.fetch(), letting authenticated users read local files, access internal services, and exfiltrate SCM tokens via crafted URLs or malicious devfiles.

  • 9.0 /10 Critical
    CVE-2026-79820 No auth

    HPE Integrated Lights-Out (iLO) 7 - Authentication Bypass

    HPE Integrated Lights-Out (iLO) 7 firmware contains a user validation failure vulnerability, letting remote attackers bypass authentication, exploit requires network access.

  • 7.7 /10 High
    CVE-2026-78861

    Mercusys AC12 - Remote Code Execution

    Mercusys AC12 V2 contains a remote code execution caused by a hardcoded 512-bit RSA Private Key, letting local attackers execute arbitrary code, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-78860 Auth required

    Mercusys AC12 V2 - Remote Code Execution

    Mercusys AC12 V2 contains a local code execution vulnerability caused by storage of information in plaintext, letting local attackers execute arbitrary code, exploit requires local access.

  • 7.9 /10 High
    CVE-2026-77805 Auth required

    In Progress Telerik Fiddler Classic - Privilege Escalation

    In Progress Telerik Fiddler Classic for Windows < 6.0.20262.10021 contains a privilege escalation caused by insufficient integrity checks on external helper tools, letting local low-privilege attackers execute unintended code with elevated privileges, exploit requires user to launch the tool and approve elevation prompt.

  • 8.1 /10 High
    CVE-2026-77226 No auth

    Camunda - Broken Access Control

    Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability caused by improper admin group membership checks in the Admin web application's first-run setup endpoint, letting unauthenticated remote attackers create admin accounts, exploit requires camunda-admin group to be empty while system is administered.

  • 8.5 /10 High
    CVE-2026-63277 PoC publicNo auth

    LibreOffice Calc - Remote Code Execution

    LibreOffice Calc contains a remote code execution vulnerability caused by loading a Java database driver from a remote location via external data source links, letting attackers execute Java code remotely, exploit requires opening a crafted document.