Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 280 of 767

  • 8.8 /10 High
    CVE-2025-15700 Auth required

    AWP Classifieds WordPress plugin - Unrestricted File Upload

    AWP Classifieds WordPress plugin < 4.4.9 contains an unrestricted file upload vulnerability caused by improper validation of files extracted from uploaded ZIP archives during listing-import, letting users with management capability upload arbitrary PHP files and achieve remote code execution.

  • 7.2 /10 High
    CVE-2026-97147 Auth required

    OpenStack Mistral - Broken Access Control

    OpenStack Mistral through 23.0.0 contains a broken access control vulnerability caused by improper resource resolution in v2 API write paths, letting authenticated project members modify other projects' resources, exploit requires authentication and API exposure.

  • 7.5 /10 High
    CVE-2026-97031 No auth

    Server Process - Denial of Service

    A server process contains a memory exhaustion vulnerability caused by allowing multiple ECH outer extension references, letting remote attackers cause denial of service, exploit requires sending crafted packets.

  • 10.0 /10 Critical
    CVE-2026-96207 No auth

    Microsoft Partner Center - Authentication Bypass

    Microsoft Partner Center contains a broken authentication caused by improper certificate validation, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-95210

    GnuTLS - Weak Cryptography

    GnuTLS 3.8.13 contains an insecure certificate validation caused by acceptance of certificates with invalid extensions, letting attackers bypass certificate validation, exploit requires attacker to present crafted certificates.

  • 7.5 /10 High
    CVE-2026-95209 No auth

    gnutls - Denial of Service

    gnutls v3.8.13 contains a denial of service caused by rejection of legitimate CA certificates, letting attackers cause service disruption, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-95208

    wolfSSL - Denial of Service

    wolfSSL v5.9.1 and v5.9.2 contain a denial of service caused by improper handling in ConfirmNameConstraints() function when processing crafted Certificate Authority certificates, letting attackers cause valid certificates without SAN to be rejected, exploit requires crafted CA certificates.

  • 7.5 /10 High
    CVE-2026-95184 No auth

    GnuTLS - Denial of Service

    GnuTLS v3.8.13 contains improper certificate validation causing rejection of legitimate certificates, letting attackers cause denial of service by blocking valid users, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-95116 No auth

    libming - Denial of Service

    libming <= 0.4.8 contains a denial of service caused by improper handling in readtag_file() in src/blocks/fromswf.c, letting remote attackers cause application crash, exploit requires crafted SWF file.

  • 8.8 /10 High
    CVE-2026-94585 No auth

    Brocade Fabric OS - Authentication Bypass

    Brocade Fabric OS < 9.2.2d on MXG610 contains an authentication bypass caused by an unauthenticated endpoint in the Single Sign-On workflow, letting unauthenticated network-adjacent attackers gain administrative access.

  • 7.8 /10 High
    CVE-2026-94582

    Brocade Fabric OS - Buffer Overflow

    Brocade Fabric OS < 10.0.1 contains a buffer overflow caused by improper bounds checking in internal diagnostic and route validation routines of the FSPF protocol, letting attackers cause daemon crash or execute code, exploit requires chaining other vulnerabilities.

  • 8.0 /10 High
    CVE-2026-94579 Auth required

    Brocade Fabric OS - Command Injection

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an OS command injection caused by improper handling of shell metacharacters in usernames or profile identifiers during SSH session termination, letting authenticated users execute arbitrary commands with root privileges, exploit requires authentication via external directory or AAA service.

  • 8.8 /10 High
    CVE-2026-94578 Auth required

    Brocade Fabric OS - Broken Access Control

    Brocade Fabric OS < 10.0.1 contains a broken access control vulnerability caused by improper authorization logic in the AAA integration framework, letting remote authenticated users gain root-equivalent chassis access by crafted VSAs or directory claims.

  • 7.8 /10 High
    CVE-2026-94577 Auth required

    Brocade Fabric OS - Privilege Escalation

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contains a privilege escalation caused by improper CLI authorization handling, letting authenticated users bypass RBAC and elevate privileges to root, exploit requires authenticated user or local process.

  • 8.0 /10 High
    CVE-2026-94576 Auth required

    Brocade Fabric OS - Authentication Bypass & Privilege Escalation

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an authentication bypass and privilege escalation caused by flawed authorization checks in the account management interface, letting authenticated users escalate privileges by modifying other accounts, exploit requires authenticated user access.