Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 295 of 767
- 9.8 /10 CriticalCVE-2026-103692 No auth
Frontend Dashboard WordPress - Broken Access Control
Frontend Dashboard WordPress plugin < 3.0.5 contains a broken access control vulnerability caused by lack of authorization and nonce checks on actions, letting unauthenticated attackers take over any account including administrators.
- 9.4 /10 CriticalCVE-2026-103663
Ollama - Path Traversal & Remote Code Execution
Ollama < 0.35.0 contains a path traversal caused by insufficient validation of layer digests in /api/pull endpoint, letting unauthenticated remote attackers write malicious files outside the model store, leading to remote code execution as root, exploit requires server process write access to /usr/lib/ollama.
- 7.5 /10 HighCVE-2026-103649 No auth
Progressive Robot hMailServer - Denial of Service
Progressive Robot hMailServer 6.3.0 through 6.3.5 Linux builds contain a denial of service caused by missing network timeouts in socket handling, letting remote attackers hold server threads indefinitely, exploit requires sending crafted mail to trigger outbound delivery to attacker-controlled domains.
- 8.0 /10 HighCVE-2026-103647 No auth
Progressive Robot hMailServer - Stored XSS
Progressive Robot hMailServer 6.3.2 through 6.3.5 contains a stored XSS caused by unsafe rendering of decrypted S/MIME or OpenPGP message attachments as blob URLs in webmail, letting remote attackers execute scripts in the user's session, exploit requires REST API enabled.
- 9.8 /10 CriticalCVE-2026-103646 No auth
Ultimate Multisite WordPress - Authentication Bypass
Ultimate Multisite WordPress plugin < 2.17.0 contains an authentication bypass caused by inconsistent email normalization in duplicate-account check, letting unauthenticated attackers log in as existing users, exploit requires checkout form without password and target account without customer record.
- 7.5 /10 HighCVE-2026-103309 No auth
GPTranslate WordPress - Stored XSS
GPTranslate WordPress plugin < 2.34.14 contains a stored XSS caused by improper restriction and escaping of stored translations, letting unauthenticated attackers execute scripts on translated pages, exploit requires server-side translations enabled.
- 7.8 /10 HighCVE-2026-103010 Auth required
Progressive Robot hMailServer - Buffer Overflow
Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows contains a heap-based buffer overflow caused by unchecked long hexadecimal input in the BlowFishEncryptor::DecryptFromString routine, letting local users write beyond buffer limits, potentially causing denial of service or code execution, exploit requires local access without authentication.
- 8.7 /10 HighCVE-2026-102784 No auth
Joomla Extension balbooa.com Gridbox - Cross-Site Request Forgery
Joomla Extension balbooa.com Gridbox < 2.20.4.0 contains a cross-site request forgery caused by missing session token validation on GET requests in the addLanguage action, letting attackers perform unauthorized actions with victim's privileges, exploit requires victim to have core.tools permission.
- 8.7 /10 HighCVE-2026-102488 Auth required
Octopus Server - Broken Access Control
Octopus Server contains a broken access control caused by incorrect evaluation of multiple scoped permission assignments, letting highly privileged users obtain deployment permissions beyond their granted scope, exploit requires high privilege user access.
- 8.8 /10 HighCVE-2026-101024 Auth required
Satel Netco Design - Path Traversal
Satel Netco Design < 2.1.7 contains a path traversal caused by improper validation in data export functionality, letting authenticated users with Viewer privileges write files, potentially leading to unauthorized file modification or code execution.
- 9.1 /10 CriticalCVE-2026-97720 No auth
Apache Impala - Authentication Bypass
Apache Impala <= 4.5.2 contains a broken authentication caused by improper JWT/OAuth token signature validation in executor webserver, letting attackers access protected resources, exploit requires webserver configured to accept JWT/OAuth tokens.
- 8.7 /10 HighCVE-2026-97716 No auth
Secure Access - Denial of Service
Secure Access servers < 14.60 contain a denial of service caused by specially crafted traffic in the connection setup sub-system, letting unauthenticated attackers cause persistent service disruption, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-97715 Auth required
Secure Access - Denial of Service
Secure Access servers < 14.60 contain a denial of service vulnerability caused by malformed data in the client registration process, letting authenticated attackers cause persistent denial of service, exploit requires authentication.
- 8.2 /10 HighCVE-2026-97714 No auth
Secure Access - Authentication Denial of Service
Secure Access servers < 14.60 contain a denial of service vulnerability caused by malformed response handling in the authentication sub-system, letting attackers cause persistent denial of service remotely, exploit requires network access.
- 8.3 /10 HighCVE-2026-97680 Auth required
IBM Langflow OSS - Broken Access Control
IBM Langflow OSS 1.0.0 through 1.12.2 contains an improper access control vulnerability in the vertex result caching subsystem, letting remote authenticated attackers obtain sensitive information or inject malicious data.