Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 281 of 767

  • 9.9 /10 Critical
    CVE-2026-94510 No auth

    Microsoft Bookings - Authorization Bypass

    Microsoft Bookings contains an authorization bypass caused by user-controlled key manipulation, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-94440 No auth

    Multipart Form Parser - Denial of Service

    A multipart form parser contains a memory limit bypass caused by improper handling of remaining limit at the start of a part, letting attackers read arbitrarily long lines into memory, exploit requires crafted multipart requests.

  • 7.5 /10 High
    CVE-2026-94439 No auth

    HTTP Server - HTTP Request Smuggling

    An HTTP server improperly continues to read and serve HTTP requests after sending a 2xx response to an HTTP/1 CONNECT request without hijacking the connection, causing request smuggling due to tunnel misinterpretation.

  • 7.1 /10 High
    CVE-2026-93860 Auth required

    OpenStack Mistral - Broken Access Control

    OpenStack Mistral through 23.0.0 contains a broken access control caused by lack of policy enforcement in /v2/maintenance API controller, letting any valid token holder read and change cluster-wide maintenance state, exploit requires valid Mistral token.

  • 8.7 /10 High
    CVE-2026-93858 Auth required

    OpenStack Mistral - Command Injection

    OpenStack Mistral through 23.0.0 contains a command injection caused by passing user-supplied proxy_command to paramiko.ProxyCommand, letting authenticated project members execute arbitrary local commands, exploit requires authentication.

  • 8.5 /10 High
    CVE-2026-93699 Auth required

    WP Toolkit for cPanel - Command Injection

    WP Toolkit for cPanel contains a command injection caused by improper argument handling, letting local users execute arbitrary code as other accounts on the same server, exploit requires local access.

  • 9.8 /10 Critical
    CVE-2026-93034

    SGLang - Remote Code Execution

    SGLang contains a remote code execution vulnerability caused by unconditionally deserializing PickleWrapper payloads via pickle.loads() in the ZMQ message decoder, letting remote attackers execute arbitrary code, exploit requires data-parallel attention enabled with non-loopback --dist-init-addr.

  • 7.7 /10 High
    CVE-2026-93017 Auth required

    OpenShift insights-operator-gather - Broken Access Control

    OpenShift insights-operator-gather ClusterRole grants the operator's service account unrestricted read access to all secrets across all namespaces, letting attackers with gather service account access read any secret, exploit requires attacker to spawn a pod with the gather service account.

  • 9.8 /10 Critical
    CVE-2026-92555 PoC publicNo auth

    AKIN Software AKINSOFT WOLVOX Control Panel - Information Disclosure

    AKIN Software AKINSOFT WOLVOX Control Panel 26.02.25 before 26.02.26 contains an information disclosure vulnerability caused by insertion of sensitive information into sent data, letting attackers pull data from system resources, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-9209 No auth

    mJobTime - SQL Injection & Remote Code Execution

    mJobTime through 15.7.3.32 contains an unauthenticated SQL injection caused by execution of caller-supplied SQL in Login.aspx admin panel handlers, letting attackers achieve pre-authentication remote code execution as LocalSystem via HTTP request.

  • 7.3 /10 High
    CVE-2026-91844 Auth required

    İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip - Unrestricted File Upload

    İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip v1.6.4 to before v1.6.6 contains an unrestricted file upload vulnerability caused by lack of file type restrictions, letting attackers upload malicious files remotely, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-89091 No auth

    ansible-core - Path Traversal & Remote Code Execution

    ansible-core contains a path traversal caused by improper symlink resolution in ansible-galaxy collection install archive extraction, letting attackers overwrite arbitrary files and execute code on the control node, exploit requires victim to install a malicious collection.

  • 9.1 /10 Critical
    CVE-2026-88647

    GnuTLS - Authentication Bypass

    GnuTLS 3.8.13 contains a hostname verification bypass caused by improper Common Name fallback mechanism handling, letting attackers eavesdrop on communications via crafted certificates, exploit requires crafted certificate.

  • 9.8 /10 Critical
    CVE-2026-88131 No auth

    Microsoft Dataverse - Insecure Deserialization

    Microsoft Dataverse contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 7.3 /10 High
    CVE-2026-87687 Auth required

    Brocade Fabric OS - Broken Access Control

    Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an authorization and input validation vulnerability caused by improper validation of fabric identifiers, letting authenticated restricted users perform unauthorized cross-fabric operations and view configuration details, exploit requires authenticated user with restricted privileges.