Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 279 of 695

  • 9.1 /10 Critical
    CVE-2017-20285 No auth

    YAML Perl - Insecure Deserialization

    YAML for Perl < 1.30 contains an insecure deserialization vulnerability caused by loading documents that trigger DESTROY methods of arbitrary classes, letting attackers execute arbitrary code, exploit requires crafted YAML input.

  • 7.5 /10 High
    CVE-2026-97307 No auth

    StylemixThemes Cost Calculator Builder - Information Disclosure

    StylemixThemes Cost Calculator Builder <= 4.0.17 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information remotely, exploit requires crafted requests.

  • 7.1 /10 High
    CVE-2026-97276 No auth

    VeronaLabs WP Statistics - Reflected XSS

    VeronaLabs WP Statistics <= 14.16.14 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-93549 No auth

    CoCart WordPress plugin - Cross-Site Request Forgery

    CoCart WordPress plugin < 4.9.7 contains a cross-site request forgery vulnerability caused by improper scoping of REST API authentication filter, letting attackers create new administrator accounts via logged-in admin sessions.

  • 7.5 /10 High
    CVE-2026-88779 CISA KEV

    CVE-2026-88779

    Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

  • 7.4 /10 High
    CVE-2026-105222

    alexpechkarev/google-maps - Man-in-the-Middle

    alexpechkarev/google-maps Laravel package through 12.16 contains a man-in-the-middle vulnerability caused by disabling TLS certificate verification via ssl_verify_peer set to FALSE, letting on-path attackers intercept requests, steal API keys, and tamper with responses, exploit requires network interception capability.

  • 7.4 /10 High
    CVE-2026-105221 PoC public

    Gist RubyGem - Improper Certificate Validation

    Gist RubyGem < 6.1.0 contains an improper certificate validation vulnerability caused by VERIFY_NONE setting in http_connection in lib/gist.rb, letting on-path attackers intercept and modify HTTPS traffic, exploit requires network interception capability.

  • 7.8 /10 High
    CVE-2026-105220 No auth

    Twine 2 desktop - Stored XSS

    Twine 2 desktop <= 2.12.0 contains a stored XSS caused by execution of markup from imported story files in importStories(), letting attackers execute code as the user via crafted story files, exploit requires opening malicious story files.

  • 7.5 /10 High
    CVE-2026-105219 No auth

    Mammoth.js - Denial of Service

    Mammoth.js > 1.3.0 < 1.12.3 contains a denial of service caused by overlapping regex alternatives in the style map tokeniser in lib/styles/parser/tokeniser.js, letting attackers block the Node.js event loop by supplying crafted .docx files.

  • 7.4 /10 High
    CVE-2026-105218 No auth

    gopay - Man In The Middle

    gopay before 1.5.119 contains a man-in-the-middle vulnerability caused by disabled TLS certificate verification in defaultClient() in pkg/xhttp/client.go, letting attackers impersonate payment provider APIs and intercept or modify sensitive data, exploit requires network access.

  • 7.4 /10 High
    CVE-2026-105216 No auth

    go-micro - Man-in-the-Middle

    go-micro < 6.0.0 contains a man-in-the-middle vulnerability caused by improper certificate validation with InsecureSkipVerify set to true by default, letting network attackers intercept or modify service traffic, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-105215 No auth

    ZITADEL - Authentication Bypass

    ZITADEL < 3.4.14 and 4.x < 4.16.2 contain an authentication bypass caused by trusting client-supplied external identity fields without completed IdP callback in hosted Login V1 UI, letting unauthenticated attackers pre-create accounts bound to victim's external IdP identity.

  • 8.2 /10 High
    CVE-2026-105213 No auth

    ZITADEL - Authentication Bypass

    ZITADEL < 4.17.1 contains a broken authentication caused by not checking an organization's inactive state during Login V2, letting users of deactivated organizations sign in and obtain tokens, exploit requires valid user credentials or session.

  • 7.5 /10 High
    CVE-2026-105212 No auth

    ZITADEL - Authentication Bypass

    ZITADEL 3.x < 3.4.14 and 4.x < 4.16.2 contain an authentication bypass caused by acceptance of passkey or authenticator enrollment on identify-only login sessions before primary factor verification, letting unauthenticated attackers log in as users, exploit requires knowledge of victim's login name.

  • 8.1 /10 High
    CVE-2026-105211 No auth

    ZITADEL - Authentication Bypass

    ZITADEL < 4.17.1 contains an authentication bypass caused by OTP code exposure via returnCode delivery type in Login V2, letting unauthenticated attackers take over accounts including administrators, exploit requires victim to have OTP-Email and OTP-SMS enrolled.